Communication Dans Un Congrès Année : 2024

Robust Stack Smashing Protection for WebAssembly

Résumé

WebAssembly is an instruction set architecture and binary format standard, designed for secure execution by an interpreter. This technology is identified as an alternative for current containerization technologies that is suitable for secure and lightweight orchestration for 5G/6G environments. Previous work has shown that WebAssembly is vulnerable to buffer overflow due to the lack of effective protection mechanisms. In this paper, we evaluate the implementation of Stack Smashing Protection (SSP) in WebAssembly standalone runtimes, and uncover two weaknesses in their current implementation. The first one is the possibility to overwrite the SSP reference value because of the contiguous memory zones inside a WebAssembly process. The second comes from the reliance of WebAssembly on the runtime to provide randomness in order to initialize the SSP reference value, which impacts the robustness of the solution. We address these two flaws by hardening the SSP implementation in terms of storage and random generator failure, in a way that is generalizable to all of WebAssembly. We evaluate our new, more robust, solution to prove that the implemented improvements do not reduce the efficiency of SSP.
Fichier principal
Vignette du fichier
article.pdf (412.42 Ko) Télécharger le fichier
Origine Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-04888542 , version 1 (15-01-2025)

Identifiants

  • HAL Id : hal-04888542 , version 1

Citer

Quentin Michaud, Yohan Pipereau, Olivier Levillain, Dhouha Ayed. Robust Stack Smashing Protection for WebAssembly. IEEE Future Networks World Forum 2024, Oct 2024, Dubai, United Arab Emirates. ⟨hal-04888542⟩
0 Consultations
0 Téléchargements

Partager

More