Runwasi
Monthly
Native code execution inside the shim zygote process is possible in runwasi's containerd-shim-wasmtime-v1 prior to 0.6.1 when a victim pulls and runs an attacker-crafted OCI image whose single Wasm layer is actually Wasmtime precompiled (serialized native-code) bytes. Because the shim trusts precompiled-format bytes from image layers as if they came from the trusted precompile-cache path, it deserializes them without normal WebAssembly validation, yielding the filesystem, environment, credentials, networking, and Linux syscall access of the workload container; the escape reaches the workload container boundary but does not by itself break container isolation or give direct host code execution. Per the CVSS vector the attack is network-reachable with no privileges (PR:N), though the independent assessment notes required user interaction (UI:R) to induce the victim to run the image; no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the issue is fixed in 0.6.1.
Native code execution inside the shim zygote process is possible in runwasi's containerd-shim-wasmtime-v1 prior to 0.6.1 when a victim pulls and runs an attacker-crafted OCI image whose single Wasm layer is actually Wasmtime precompiled (serialized native-code) bytes. Because the shim trusts precompiled-format bytes from image layers as if they came from the trusted precompile-cache path, it deserializes them without normal WebAssembly validation, yielding the filesystem, environment, credentials, networking, and Linux syscall access of the workload container; the escape reaches the workload container boundary but does not by itself break container isolation or give direct host code execution. Per the CVSS vector the attack is network-reachable with no privileges (PR:N), though the independent assessment notes required user interaction (UI:R) to induce the victim to run the image; no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the issue is fixed in 0.6.1.