Add advisory for unsound problem in wasmtime_jit_debug

crates/wasmtime-jit-debug/RUSTSEC-0000-0000.md

@@ -0,0 +1,30 @@
+```toml
+[advisory]
+id = "RUSTSEC-0000-0000"
+package = "wasmtime-jit-debug"
+date = "2024-07-06"
+url = "https://github.com/bytecodealliance/wasmtime/issues/8905"
+informational = "unsound"
+categories = ["memory-exposure"]
+
+[affected]
+functions = { "wasmtime_jit_debug::perf_jitdump::JitDumpFile::dump_code_load_record" = ["<= 24.0.0"] }
+
+[versions]
+patched = [">= 24.0.0"]
+```
+
+# Dump Undefined Memory by `JitDumpFile`
+
+The unsound function `dump_code_load_record` uses `from_raw_parts` to directly convert 
+the pointer `addr` and `len` into a slice without any validation and that memory block 
+would be dumped.
+
+Thus, the 'safe' function dump_code_load_record is actually 'unsafe' since it requires 
+the caller to guarantee that the addr is valid and len must not overflow.
+Otherwise, the function could dump the memory into file illegally, causing memory leak.
+
+> **Note**: this is an internal-only crate in the Wasmtime project not intended for
+external use and is more strongly signaled nowadays as of
+[bytecodealliance/wasmtime#10963](https://github.com/bytecodealliance/wasmtime/pull/10963).
+Please open an issue in Wasmtime if you're using this crate directly.