Stream: git-wasmtime

Topic: wasmtime / issue #15006 RUSTSEC-2026-0410: WebAssembly al...

view this post on Zulip Wasmtime GitHub notifications bot (Oct 27 2026 at 00:13):

github-actions[bot] opened issue #15006:

WebAssembly allocator shim corrupts memory on allocation failure

Details
Package zstd-sys
Version 2.0.9+zstd.1.5.5
URL https://github.com/gyscos/zstd-rs/commit/165d1625553c236b9700ca794b8a7c51f5d98314
Date 2026-10-16
Patched versions >=2.1.2
Unaffected versions <2.0.9

On wasm32, zstd-sys provides malloc and free to the C library through a
shim over Rust's allocator. The shim did not check for allocation failure:
it wrote its size header to address 0 and returned address 4, which the C
library used as a valid buffer. free(NULL) also read below address 0.

Whenever the instance cannot grow its memory by what a frame asks for, a
small crafted frame (a 9-byte header declaring a 128 MiB window is enough)
made decompression write decoded data over the bottom of the module's
linear memory, instead of failing. The corruption stays within the wasm
sandbox.

The flaw was corrected by returning NULL on allocation failure or size
overflow, and by making free(NULL) a no-op.

See advisory page for additional details.

view this post on Zulip Wasmtime GitHub notifications bot (Oct 27 2026 at 00:39):

pchickey closed issue #15006:

WebAssembly allocator shim corrupts memory on allocation failure

Details
Package zstd-sys
Version 2.0.9+zstd.1.5.5
URL https://github.com/gyscos/zstd-rs/commit/165d1625553c236b9700ca794b8a7c51f5d98314
Date 2026-10-16
Patched versions >=2.1.2
Unaffected versions <2.0.9

On wasm32, zstd-sys provides malloc and free to the C library through a
shim over Rust's allocator. The shim did not check for allocation failure:
it wrote its size header to address 0 and returned address 4, which the C
library used as a valid buffer. free(NULL) also read below address 0.

Whenever the instance cannot grow its memory by what a frame asks for, a
small crafted frame (a 9-byte header declaring a 128 MiB window is enough)
made decompression write decoded data over the bottom of the module's
linear memory, instead of failing. The corruption stays within the wasm
sandbox.

The flaw was corrected by returning NULL on allocation failure or size
overflow, and by making free(NULL) a no-op.

See advisory page for additional details.

Last updated: Oct 31 2026 at 23:03 UTC