CVE-2024-51745
Description
A flaw was found in the Wasmtime package. Wasmtime's filesystem sandbox implementation on Windows blocks access to special device filenames such as "COM1", "COM2", "LPT0", "LPT1", and so on. However, it did not block access to the special device filenames that use superscript digits, such as "COM¹", "COM²", "LPT⁰", "LPT¹", and so on. Untrusted Wasm programs that are given access to any filesystem directory could bypass the sandbox and access devices through those special device filenames with superscript digits and, through them, gain access to peripheral devices connected to the computer or network resources mapped to those devices.
Statement
This vulnerability is specific to Windows. No Red Hat products are affected.
Understanding the Weakness (CWE)
Other
Technical Impact: Varies by Context
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
