Catégorie: Conférence
Auteurs: Quentin Michaud, Yohan Pipereau, Olivier Levillain et Dhouha Ayed
Date: octobre 2024

WebAssembly is an instruction set architecture and binary format standard, designed for secure execution by an interpreter. Previ- ous work has shown that WebAssembly is vulnerable to buffer overflow due to the lack of effective protection mechanisms.

In this paper, we evaluate the implementation of Stack Smashing Pro- tection (SSP) in WebAssembly standalone runtimes, and uncover two weaknesses in their current implementation. The first one is the pos- sibility to overwrite the SSP reference value because of the contiguous memory zones inside a WebAssembly process. The second comes from the reliance of WebAssembly on the runtime to provide randomness in order to initialize the SSP reference value, which impacts the robustness of the solution.

We address these two flaws by hardening the SSP implementation in terms of storage and random generator failure, in a way that is general- izable to all of WebAssembly. We evaluate our new, more robust, solution to prove that the implemented improvements do not reduce the efficiency of SSP.

Présenté lors de la conférence PLAS à Salt Lake City, USA en octobre 2024

BibTeX Version longue de l'article