GHSA-g4v2-cjqp-rfmq Critical Use-After-Free in Wasmi's Linear Memory

• crates.io wasmi: >= 0.41.0, < 0.41.2 → fixed in 0.41.2 • crates.io wasmi: >= 0.42.0, < 0.47.1 → fixed in 0.47.1 • crates.io wasmi: >= 0.50.0, < 0.51.3 → fixed in 0.51.3 • crates.io wasmi: >= 1.0.0, < 1.0.1 → fixed in 1.0.1

Summary A use-after-free vulnerability has been discovered in the linear memory implementation of Wasmi. This issue can be triggered by a WebAssembly module under certain memory growth conditions, potentially leading to memory corruption, information disclosure, or code execution. Impact • Confidentiality: High – attacker-controlled memory reads possible. • Integrity: High – memory corruption may allow arbitrary writes. • Availability: High – interpreter crashes possible. Affected Versions Wasmi `v0.41.0` through Wasmi `v1.0.0`. Workarounds • Upgrade to the latest patched version of Wasmi. • Consider limiting the maximum linear memory sizes where feasible. Credits This vulnerability was discovered by Robert T. Morris (RTM).