GHSA-m758-wjhj-p3jq Wasmtime has a possible panic when lifting `flags` component value

• crates.io wasmtime: < 24.0.7 → fixed in 24.0.7 • crates.io wasmtime: >= 25.0.0, < 36.0.7 → fixed in 36.0.7 • crates.io wasmtime: >= 37.0.0, < 42.0.2 → fixed in 42.0.2 • crates.io wasmtime: >= 43.0.0, < 43.0.1 → fixed in 43.0.1

Impact Wasmtime contains a possible panic which can happen when a `flags`-typed component model value is lifted with the `Val` type. If bits are set outside of the set of flags the component model specifies that these bits should be ignored but Wasmtime will panic when this value is lifted. This panic only affects wasmtime's implementation of lifting into `Val`, not when using the `flags!` macro. This additionally only affects `flags`-typed values which are part of a WIT interface. This has the risk of being a guest-controlled panic within the host which Wasmtime considers a DoS vector. Patches Wasmtime 24.0.7, 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime. Workarounds There is no workaround for this bug if a host meets the criteria to be affected. To be affected a host must be using `wasmtime::component::Val` and possibly work with a `flags` type in the component model.