GHSA-jxhv-7h78-9775 Wasmtime: Panic when transcoding misaligned utf-16 strings

• crates.io wasmtime: < 24.0.7 → fixed in 24.0.7 • crates.io wasmtime: >= 25.0.0, < 36.0.7 → fixed in 36.0.7 • crates.io wasmtime: >= 37.0.0, < 42.0.2 → fixed in 42.0.2 • crates.io wasmtime: >= 43.0.0, < 43.0.1 → fixed in 43.0.1

Impact Wasmtime's implementation of transcoding strings into the Component Model's `utf16` or `latin1+utf16` encodings improperly verified the alignment of reallocated strings. This meant that unaligned pointers could be passed to the host for transcoding which would trigger a host panic. This panic is possible to trigger from malicious guests which transfer very specific strings across components with specific addresses. Host panics are considered a DoS vector in Wasmtime as the panic conditions are controlled by the guest in this situation. Patches Wasmtime 24.0.7, 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime. Workarounds There is no workaround for this bug. Hosts are recommended to updated to a patched version of Wasmtime.