Unsafe Module::deserialize_file on guest-writable paths

[rennergade]

src/wasmtime/crates/lind-multi-process/src/lib.rs:1094-1096

Module::deserialize_file loads pre-compiled native code from guest-writable paths within the chroot. A malicious guest could replace a .cwasm file and achieve arbitrary native code execution.

Should use Module::from_file unless cwasm files are in a read-only location.

[qianxichen233]

detect a malicious cwasm file is unlikely to be possible. cwasm file are not safe by nature, one can easily modify the instructions within a cwasm to make it executes instructions that is not generated by wasm compiler, and I have done this before (modifying a cwasm file to directly embed syscall instruction which bypassing host and directly invoke host syscall from guest).

Just limiting the usage of cwasm file in particular scenario might be a workaround (e.g. only accept wasm file if some option is provided)