CVE-2025-61670 Wasmtime C/C++ API anyref/externref内存泄漏漏洞

// PoC for CVE-2025-61670: Wasmtime C API memory leak with externref // This PoC demonstrates the memory leak caused by the typo in wasmtime_val_unroot // and the missing unroot for host-defined function return values. #include <stdio.h> #include <stdlib.h> #include <wasmtime.h> // Simulate repeated creation and "unrooting" of externref values // to demonstrate the memory leak in Wasmtime 37.0.0/37.0.1 void demonstrate_leak() { wasm_engine_t *engine = wasm_engine_new(); wasm_store_t *store = wasm_store_new(engine); // Repeatedly create externref values and attempt to unroot them // In vulnerable versions, wasmtime_val_unroot is a no-op due to a typo for (int i = 0; i < 1000000; i++) { wasmtime_val_t val; val.kind = WASMTIME_EXTERNREF; val.of.externref = wasmtime_externref_new(store, (void *)(intptr_t)i); // This call should free the memory but is broken in vulnerable versions wasmtime_val_unroot(&val); // Memory accumulates because unroot doesn't actually work } // Even destroying the store won't free the leaked memory // because OwnedRooted<T> allocates outside the store wasm_store_delete(store); wasm_engine_delete(engine); // In vulnerable versions, significant memory remains allocated printf("Memory leak demonstrated - check process memory usage\n"); } int main() { demonstrate_leak(); return 0; }