CVE-2025-61670 Root-Cause Fix Review for Wasmtime C/C++ GC Reference Leaks

Vulnerability

CVE-2025-61670 describes a memory leak in Wasmtime v37.0.0-37.0.1 C/C++ bindings where local guest modules can exhaust host memory and trigger denial of service. The affected area is WebAssembly GC reference handling in the C/C++ API, specifically rooted externref, anyref, and composite val lifetimes.

The patch evidence in the Wasmtime commit shows the pre-fix API depended on explicit context-bound clone/unroot calls and exposed raw handles through methods such as raw(). In the vulnerable path in func.hh, an optional C++ ExternRef was converted with wasmtime_externref_to_raw(cx.raw_context(), ref->raw()), which preserved the wrapper's ownership while also materializing a raw representation for the call boundary. Without deterministic unrooting semantics in the wrapper types, repeated calls could accumulate rooted GC references.

The vulnerable design also required callers to pass a wasmtime_context_t * into clone/unroot functions in val.h, indicating lifetime operations were externalized rather than embedded in object semantics. That is a common source of leaks in C++ bindings because copies, moves, temporaries, and exception paths can bypass manual cleanup.

// Vulnerable marshaling path from func.hh
p->externref = wasmtime_externref_to_raw(cx.raw_context(), ref->raw());

// Vulnerable API shape from val.hh
ExternRef clone(Store::Context cx) {
  wasmtime_externref_t other;
  wasmtime_externref_clone(cx.ptr, &val, &other);
  return ExternRef(other);
}
void unroot(Store::Context cx) { wasmtime_externref_unroot(cx.ptr, &val); }

The resulting issue is consistent with the public records at MITRE and NVD: guest-triggerable host memory growth caused by leaked GC-managed references in the embedding API.

Patch

The patch in adff9d9d0f09569203709d5687e5a7dc8e1ad0a3 restructures ownership and cleanup around C++ wrapper types.

First, val.h removes the explicit context parameter from clone/unroot entry points:

WASM_API_EXTERN void wasmtime_anyref_clone(const wasmtime_anyref_t *anyref,
WASM_API_EXTERN void wasmtime_anyref_unroot(wasmtime_anyref_t *ref);
WASM_API_EXTERN void wasmtime_externref_clone(const wasmtime_externref_t *ref,
WASM_API_EXTERN void wasmtime_externref_unroot(wasmtime_externref_t *ref);
WASM_API_EXTERN void wasmtime_val_unroot(wasmtime_val_t *val);
WASM_API_EXTERN void wasmtime_val_clone(const wasmtime_val_t *src,

Second, val.hh adds full RAII behavior for ExternRef, AnyRef, and Val: copy constructors clone, move constructors null out the source, assignment operators unroot old state before replacement, and destructors unroot automatically. This is the core remediation because it makes rooted reference cleanup deterministic across normal C++ object lifetimes.

~ExternRef() { wasmtime_externref_unroot(&val); }

uint32_t take_raw(Store::Context cx) {
  uint32_t ret = wasmtime_externref_to_raw(cx.raw_context(), &val);
  wasmtime_externref_set_null(&val);
  return ret;
}

uint32_t borrow_raw(Store::Context cx) const {
  return wasmtime_externref_to_raw(cx.raw_context(), &val);
}

Third, func.hh changes argument marshaling for optional ExternRef from a borrowed/raw conversion to an ownership-transferring path:

static void store(Store::Context cx, wasmtime_val_raw_t *p,
                  std::optional<ExternRef> &&ref) {
  if (ref) {
    p->externref = ref->take_raw(cx);
  } else {
    p->externref = 0;
  }
}

This is significant: take_raw converts to the raw ABI form and then nulls the wrapper, preventing the wrapper destructor from retaining or double-owning the rooted reference. The patch also retains a separate borrow_raw path for non-consuming access, which clarifies ownership semantics.

Finally, store.hh adds a C++ convenience wrapper for store GC:

void gc() { context().gc(); }

That addition is not the primary fix, but it improves embedders' ability to force collection of now-correctly unrooted objects.

Review

Pros

• The patch addresses the ownership model directly rather than only adding ad hoc cleanup calls. RAII destructors for ExternRef, AnyRef, and Val are the strongest signal that the root cause was understood.
• The new copy/move operations are coherent: copy clones, move transfers, and moved-from objects are nulled. That is the correct pattern for rooted GC handles in C++ wrappers.
• take_raw in val.hh and its use in func.hh eliminate the previous ambiguity where a wrapper could remain rooted after conversion to a raw call argument.
• Removing the context parameter from clone/unroot APIs in val.h simplifies call sites and reduces the chance of mismatched cleanup logic.
• The patch also updates Val accessors to clone without explicit context, aligning composite value behavior with the new ownership model.

Cons

• The provided diff snippets do not show the underlying C implementation changes for the updated val.h signatures, so this review can only assess the header/API-level fix and wrapper semantics, not the full runtime behavior.
• error.hh shows suspicious patched lines where err_ref() returns std::get<T>(data) instead of std::get<E>(data). That appears unrelated to this CVE, but if present in the actual commit it would warrant separate validation.
• The new gc() helper may be useful operationally, but it should not be interpreted as the security fix itself; relying on explicit GC would only mask leaks if ownership were still wrong.
• The patch appears focused on C/C++ wrapper lifetime correctness. If embedders bypass these wrappers and manipulate raw C structs directly, they still need to follow the revised ownership contract correctly.

Verdict

Root-cause.

The patch appears to fix the underlying defect: rooted GC references in the C/C++ API lacked robust ownership semantics, and raw marshaling could leave wrappers retaining references after ABI conversion. By introducing destructor-based unrooting, correct copy/move behavior, and a consuming take_raw path used at the call boundary, the change removes the leak mechanism rather than merely reducing its impact. Based on the available sources, this is a technically sound remediation for the memory-exhaustion condition described in NVD and MITRE, with the primary caveat that downstream validation should confirm the corresponding C implementation matches the revised headers in the commit.