Superoptimization of WebAssembly bytecode

Arteaga, Javier Cabrera; Donde, Shrinish; Gu, Jian; Floros, Orestis; Satabin, Lucas; Baudry, Benoît; Monperrus, Martin

doi:10.1145/3397537.3397567

Cited by 9 publications

(3 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Nevertheless, it still provides a fast runtime execution speed similar to the native code execution speed. Since all contents and data for Wasm applications are transmitted through the network, minimizing the size of transmitted data is a vital optimization target factor that affects overall application performance and web experience [9]. By reducing the size of this code, the data transmission time and the time consumed for jit compile is reduced, which can affect actual application execution performance.…”

Section: Background a Webassemblymentioning

confidence: 99%

See 1 more Smart Citation

metaSafer: A Technique to Detect Heap Metadata Corruption in WebAssembly

Song,

Park,

Kwon

2023

IEEE Access

View full text Add to dashboard Cite

WebAssembly (Wasm), a technology enabling efficient native code execution in web browsers, has seen a significant rise in adoption as a popular compilation target. This has led to the emergence of lightweight web services powered by Wasm, characterized by their small binary size and reduced data transfer overhead, thanks to the inherent efficiency of Wasm. Despite their lightweight nature, these services can deliver powerful features like image/video processing, AI and graphical application that surpass the capabilities of JavaScript. To ensure lightweight web services and enhance the overall web experience, Wasm has been extensively optimized. However, these optimizations have raised concerns about memory safety, leading to memory-related vulnerabilities. Wasm's characteristic memory structure, linear memory, has vulnerabilities that provide various attack vectors to attackers. In particular, it presents various attack possibilities through metadata modification containing memory structure information. Attackers can exploit heap memory overflow in Wasm applications, allowing them to target arbitrary memory addresses, modify data, or execute arbitrary code. Such overflows can corrupt memory metadata, resulting in incorrect memory behavior. While research has mitigate memory-related weaknesses in languages such as C and C++ and architectures like X86 in recent decades, the direct application of security solutions designed for different domains to Wasm is not a practical approach. Consequently, allocators in Wasm remain vulnerable to issues like heap overflow and metadata corruption. Thus, there is a pressing need for tailored memory safety techniques and solutions that accommodate Wasm's architecture-agnostic and linear memory structures. In this paper, we propose metaSafer as a solution. By shadowing metadata from Wasm linear memory to JavaScript virtual machine memory and conducting metadata verification, metaSafer effectively blocks attack attempts and vectors. Notably, our solution achieves fast memory shadowing and validation while maintaining a small code size. Through various verification processes, we measured the performance and code size of metaSafer, revealing that it is a software-only security solution with no additional hardware requirements. metaSafer demonstrates robust metadata protection for Wasm applications with an acceptable performance overhead of up to 8% in SQLite speed tests and Polybench benchmarks.

show abstract

Section: Background a Webassemblymentioning

confidence: 99%

“…Since Wasm applications are distributed and executed through the web, the application size and performance are essential considerations [9]. To satisfy these requirements, Wasm applications often use simplified allocators such as emmalloc, which does not provide memory protection mechanisms or is used in limited coverage.…”

Section: Introductionmentioning

confidence: 99%

metaSafer: A Technique to Detect Heap Metadata Corruption in WebAssembly

Song,

Park,

Kwon

2023

IEEE Access

View full text Add to dashboard Cite

show abstract

“…Software diversification is a well-known software protection technique [12,4,19], consisting of producing numerous variants of an original program, each retaining equivalent functionality. Software diversification in Web-Assembly has many important application domains, such as optimization [5] and malware evasion [8]. It can also been used for fuzzing, a salient example of this was the discovery of a CVE in Fastly in 2021 [18], achieved through automated transformations to a WebAssembly binary.…”

Section: Introductionmentioning

confidence: 99%