Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state

QFinch assessment

Wasmtime's implementation of bulk-data-transfer WebAssembly instructions, such as `memory.copy`, contains a vulnerability when a preemption via epochs or fuel is combined with altering the store's state or cancelling a computation. To prevent these operations from taking too long Wasmtime injects fuel/epoch checks during these operations, but this enables embedders, and possible WebAssembly, to witness intermediate state in the middle of the operation. Examples of this include:

Potential impact

Wasmtime's implementation of bulk-data-transfer WebAssembly instructions, such as memory.copy, contains a vulnerability when a preemption via epochs or fuel is combined with altering the store's state or cancelling a computation. To prevent these operations from taking too long Wasmtime injects fuel/epoch checks during these operations, but this enables embedders, and possible WebAssembly, to witness intermediate state in the middle of the operation. Examples of this include: When a non-nullable WebAssembly table is grown the new elements initially start as null and are filled in as part of a loop with preemption checks. If this computation is then cancelled this left the table in a grown-but-uninitialized state where subsequent usage via WebAssembly could possibly segfault. Loads from this table are assumed to not be null due to its type, but the runtime implementation was exposed through this cancellation at a preemption point. Embedders could mutate the store during an epoch callback, such as growing a WebAssembly linear memory. During a bulk memory.copy operation, however, the pointers being copied to/from weren't recomputed between preemption points. This meant that if the linear memory moved its base address it could be possible to have a preemption, the embedder manually grows memory, and then on resumption the copy operation uses invalid pointers. Embedders could execute a GC during epoch callbacks. GC operations such as array.copy, like memory.copy above, maintained raw pointers internally in the operation which were not updated after the preemption point. This could lead to corruption of the GC heap. All of these situations are examples of embedder-driven mutations of the Store or embedder-induced resumption of a Store after a computation was cancelled. These operations expose the internal state of these WebAssembly operations which is semantically incorrect and additionally can cause segfaults for example. Exposing these bugs, however, requires explicit patterns to be present in the embedding itself such as using Store::epochdeadlinecallback and mutating wasm options. Another example is to cancel one invocation (possibly in a table.grow) and then execute more wasm afterwards within the same store. Embeddings not using Store::epochdeadlinecallback or executing code after timeouts/fuel are not affected by this issue.