Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
paritytech/wasmi
main @ f828b9a
10
Fixes
2
CVEs
HIGH
Peak severity
30.0%
Coverage
Highlights
Memory Safety: 3 prior fixes. Scrutinize any change in this area.
crates/wasmi/src/engine/executor/handler/state.rs: most-fixed (2 issues). Treat as high-risk during review.
8 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Memory Safety: A use-after-free vulnerability exists where dynamic WASM memory growth (e.g., memory.grow) triggered within host functions invalidates cached pointers to linear memory (mem0), leading to stale memory dereferences on resume. This is tracked under CVE-2025-66627.
Sandbox Escape: Cross-instance tail-calls (return_call and return_call_indirect) failed to properly preserve and restore caller instances, causing VM state corruption and allowing potential sandbox escapes.
Auth Bypass: Failure to re-sync the engine's CodeView after host function calls allowed dynamic compilation or table updates to invalidate cached code maps, leading to the execution of incorrect or unauthorized instructions.