CVE-2024-38358

Summary

CVE-2024-38358 is a newly disclosed vulnerability affecting Wasmer, a web assembly (wasm) Runtime. This issue allows WASI programs to traverse symlinks outside of the preopened directory and potentially access host filesystem if the caller sets both `oflags::creat` and `rights::fd_write`. Additionally, programs can crash the runtime by creating a symlink outside and opening it. The vulnerability has been resolved in commit `b9483d022`, which is available in release version 4.3.2. Users are strongly advised to upgrade as soon as possible, as there are currently no known workarounds for this issue.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.