CyberRota Analysis
AI-GeneratedThe vulnerability affects Wasmtime, a WebAssembly runtime, where improper permission checks during hard-link creation and renaming allow a WASI guest with read-only access to overwrite host files exposed with read permissions. This could lead to unauthorized file modifications, potentially compromising system integrity. Organizations utilizing Wasmtime versions prior to 24.0.11, 36.0.12, 45.0.3, or 46.0.1 should prioritize upgrading to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory permissions but not matching FilePerms on source and destination preopens, allowing a WASI guest with a read-only source file capability to overwrite host files exposed as FilePerms::READ through wasip1, wasip2, or wasip3 filesystem interfaces. This issue is fixed in versions 24.0.11, 36.0.12, 45.0.3, and 46.0.1.