LiveActive security incident?Get immediate response
CVE Record

CVE-2021-39219: Wrong type for `Linker`-define functions when used across two `Engine`s

Wasmtime is an open source runtime for WebAssembly & WASI. Wasmtime before version 0.30.0 is affected by a type confusion vulnerability. As a Rust library the `wasmtime` crate clearly marks which functions are safe and which are `unsafe`, guaranteeing that if consumers never use `unsafe` then it should not be possible to have memory unsafety issues in their embeddings of Wasmtime. An issue was discovered in the safe API of `Linker::func_*` APIs. These APIs were previously not sound when one `Engine` was used to create the `Linker` and then a different `Engine` was used to create a `Store` and then the `Linker` was used to instantiate a module into that `Store`. Cross-`Engine` usage of functions is not supported in Wasmtime and this can result in type confusion of function pointers, resulting in being able to safely call a function with the wrong type. Triggering this bug requires using at least two `Engine` values in an embedding and then additionally using two different values with a `Linker` (one at the creation time of the `Linker` and another when instantiating a module with the `Linker`). It's expected that usage of more-than-one `Engine` in an embedding is relatively rare since an `Engine` is intended to be a globally shared resource, so the expectation is that the impact of this issue is relatively small. The fix implemented is to change this behavior to `panic!()` in Rust instead of silently allowing it. Using different `Engine` instances with a `Linker` is a programmer bug that `wasmtime` catches at runtime. This bug has been patched and users should upgrade to Wasmtime version 0.30.0. If you cannot upgrade Wasmtime and are using more than one `Engine` in your embedding it's recommended to instead use only one `Engine` for the entire program if possible. An `Engine` is designed to be a globally shared resource that is suitable to have only one for the lifetime of an entire process. If using multiple `Engine`s is required then code should be audited to ensure that `Linker` is only used with one `Engine`.

MediumCVSS 6.3Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

Wasmtime versions before 0.30.0 could let a supposedly safe Rust embedding call a linked WebAssembly function with the wrong type. The issue only appears in unusual applications using multiple Wasmtime Engine instances. Business urgency is moderate: patch affected embeddings, but broad internet-scale exposure is not supported by the sources.

Executive priority

Treat as a targeted dependency remediation item, not an emergency incident. Prioritize products embedding Wasmtime directly, especially systems processing untrusted WebAssembly. No source here supports active exploitation.

Technical view

CVE-2021-39219 is a CWE-843 type confusion flaw in Wasmtime Linker::func_* APIs. A Linker created with one Engine could be used with a Store from another Engine, causing function pointer type confusion. Wasmtime 0.30.0 changed this unsupported cross-Engine use to panic instead of silently proceeding.

Likely exposure

Exposure is most likely in Rust applications or packages embedding wasmtime <=0.29.0 and using more than one Engine. Single-Engine embeddings are less likely affected. Fedora advisories indicate downstream package updates existed, so both application dependencies and OS packages should be checked.

Exploitation context

The source bundle does not report active exploitation, and KEV is false. The CVSS vector is local, high complexity, no privileges, and user interaction required. The advisory says triggering requires a rare cross-Engine Linker and Store pattern.

Researcher notes

The key condition is cross-Engine misuse: Linker creation with one Engine and module instantiation into a Store from another. The fix does not redesign linking; it detects the programmer error and panics. Evidence is strongest from the GitHub advisory and patch reference.

Mitigation direction

  • Upgrade Wasmtime to version 0.30.0 or later.
  • If upgrade is blocked, use one Engine for the whole program.
  • Audit multiple-Engine code so each Linker is used with one Engine only.
  • Review downstream OS package advisories for patched Wasmtime builds.

Validation and detection

  • Inventory Rust lockfiles and packages for wasmtime <=0.29.0.
  • Review embeddings for Linker::func_* use with multiple Engine instances.
  • Confirm each Linker is instantiated only with Stores from its Engine.
  • Verify patched deployments use Wasmtime 0.30.0 or vendor-updated packages.
Prepared
Confidence
high
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-843: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-39219 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.3 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
6Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.3CVSS 3.1MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H15.2Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

6.3Medium
CVSS 3.1 vector shape for CVE-2021-39219Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
bytecodealliancewasmtime<= 0.29.0Listed
Weakness

CWE details

CWE-843

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-843 · source CWE mapping

Access of Resource Using Incompatible Type ('Type Confusion')

Access of Resource Using Incompatible Type ('Type Confusion') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs