Communication Dans Un Congrès Année : 2024

Securing Stack Smashing Protection in WebAssembly Applications

Résumé

WebAssembly is an instruction set architecture and binary format standard, designed for secure execution by an interpreter. Previous work has shown that WebAssembly is vulnerable to buffer overflow due to the lack of effective protection mechanisms. In this paper, we evaluate the implementation of Stack Smashing Protection (SSP) in WebAssembly standalone runtimes, and uncover two weaknesses in their current implementation. The first one is the possibility to overwrite the SSP reference value because of the contiguous memory zones inside a WebAssembly process. The second comes from the reliance of WebAssembly on the runtime to provide randomness in order to initialize the SSP reference value, which impacts the robustness of the solution. We address these two flaws by hardening the SSP implementation in terms of storage and random generator failure, in a way that is generalizable to all of WebAssembly. We evaluate our new, more robust, solution to prove that the implemented improvements do not reduce the efficiency of SSP.
Fichier principal
Vignette du fichier
Michaud_etal_PLAS2024.pdf (516.63 Ko) Télécharger le fichier
Origine Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-04888610 , version 1 (15-01-2025)

Identifiants

  • HAL Id : hal-04888610 , version 1

Citer

Quentin Michaud, Yohan Pipereau, Olivier Levillain, Dhouha Ayed. Securing Stack Smashing Protection in WebAssembly Applications. The 19th Workshop on Programming Languages and Analysis for Security, Oct 2024, Salt Lake, United States. ⟨hal-04888610⟩
0 Consultations
0 Téléchargements

Partager

More