[arrietybeu]

Updates

• Affected products

Comments
Cranelift is published separately on crates.io as cranelift-codegen, and the vulnerable code lives in that crate: ValueDataPacked in cranelift/codegen/src/ir/dfg.rs. Before the fix the x/y fields were 24 bits wide and encode_narrow_field only range-checked with debug_assert!, so in release builds an index >= 2^24 is not masked: its upper bits spill into the adjacent fields (y into x, x into the CLIF type bits) and the decoded value/inst/block reference is wrong. Projects that depend on cranelift-codegen directly rather than through wasmtime currently get no Dependabot/OSV alert for this.

Fix commits:

• bytecodealliance/wasmtime@ba8f7d7 (Cranelift: update ValueDataPacked to support full Value range. bytecodealliance/wasmtime#12613): first released in Wasmtime 43.0.0 / cranelift-codegen 0.130.0
• bytecodealliance/wasmtime@f517bd6 (Security fixes for release 36.0.19 bytecodealliance/wasmtime#14818): the 36.0.19 backport, released as cranelift-codegen 0.123.19

The published crates on crates.io confirm this: src/ir/dfg.rs still has the x:24 | y:24 layout in 0.123.18 and in the latest release of every 0.124-0.129 line (0.124.3, 0.125.4, 0.126.2, 0.127.4, 0.128.4, 0.129.2), and has x:32 | y:32 in 0.123.19, 0.130.0 and the current 0.137.0. Cranelift is released in lockstep with Wasmtime (wasmtime-internal-cranelift 36.0.19 requires cranelift-codegen ^0.123.19, and 43.0.0 requires ^0.130.0), so the proposed ranges are the same as the existing wasmtime ranges:

• wasmtime < 36.0.19 -> cranelift-codegen < 0.123.19
• wasmtime >= 37.0.0, < 43.0.0 -> cranelift-codegen >= 0.124.0, < 0.130.0

Earlier Cranelift miscompilation advisories list both packages the same way, e.g. GHSA-ff4p-7xrq-q5r8 and GHSA-xm67-587q-r2vw

[github]

Hi there @pchickey! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory