Advisory Database
  • Advisories
  • Dependency Scanning
  1. cargo
  2. ›
  3. wasmtime
  4. ›
  5. CVE-2021-39216

CVE-2021-39216: Use after free passing `externref`s to Wasm in Wasmtime

September 20, 2021 (updated November 19, 2024)

There was a use-after-free bug when passing externrefs from the host to guest Wasm content.

To trigger the bug, you have to explicitly pass multiple externrefs from the host to a Wasm instance at the same time, either by

  • passing multiple externrefs as arguments from host code to a Wasm function,
  • or returning multiple externrefs to Wasm from a multi-value return function defined in the host.

If you do not have host code that matches one of these shapes, then you are not impacted.

References

  • crates.io/crates/wasmtime
  • github.com/advisories/GHSA-v4cp-h94r-m7xf
  • github.com/bytecodealliance/wasmtime
  • github.com/bytecodealliance/wasmtime-py/compare/0.29.0...0.30.0
  • github.com/bytecodealliance/wasmtime/commit/101998733b74624cbd348a2366d05760b40181f3
  • github.com/bytecodealliance/wasmtime/security/advisories/GHSA-v4cp-h94r-m7xf
  • github.com/pypa/advisory-database/tree/main/vulns/wasmtime/PYSEC-2021-320.yaml
  • lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WAVBRYDDUIY2ZR3K3FO4BVYJKIMJ5TP7
  • lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z2Z33FTXFQ6EOINVEQIP4DFBG53G5XIY
  • nvd.nist.gov/vuln/detail/CVE-2021-39216
  • rustsec.org/advisories/RUSTSEC-2021-0110.html

Code Behaviors & Features

Detect and mitigate CVE-2021-39216 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 0.30.0

Fixed versions

  • 0.30.0

Solution

Upgrade to version 0.30.0 or above.

Impact 6.3 MEDIUM

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

Learn more about CVSS

Weakness

  • CWE-416: Use After Free

Source file

cargo/wasmtime/CVE-2021-39216.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 14 May 2025 12:14:43 +0000.