2 ms·

How does WebAssembly fix hardware issues? For example, take Rowhammer. I don't see how running your code in a VM fixes Rowhammer; surely there would still be so

How does WebAssembly fix hardware issues? For example, take Rowhammer. I don't see how running your code in a VM fixes Rowhammer; surely there would still be some mapping of data in wasm to RAM, and I don't see why a sufficiently motivated individual couldn't determine and subsequently exploit that mapping. Or what does WASM do about the concerns that major CPU vendors embed a second co-processor running untrusted, unauditable code with ring -1 access alongside the main CPU?¹ ¹which may or may not be active, depending on CPU model and configuration. I've never really fully understood when it is, or isn't, but I think it's somewhat moot. Further, this assumes the runtime (which is not just the WASM runtime: system calls and other functionality will inevitably need access to the actual, underlying hardware in order to do their job) from being buggy, and since the code is now in ring 0, you get all the consequences of that. (Full, unrestricted access to everything. At least previously, you'd need to find some root exploit to get that.) (Also, as another poster hints below, since everything is running inside the same protection layer from the CPU's point of view, what prevents you from just running the same attack, in spirit, as Spectre? Only now, there is no protection — everything is ring 0 — so the CPU is "correct" to speculate a read. Sure, the VM will deny it to the code inside the VM, but that didn't matter in the case of Spectre?)

dleslie 8y ago
RowHammer most certainly works in a VM: https://github.com/IAIK/rowhammerjs https://github.com/IAIK/rowhammerjs
candiodari 8y ago
> since the code is now in ring 0, you get all the consequences of that No you don't. Because WASM does not provide many of the facilities that real assembly provides. So, for instance, there is no way to stack-smash using WASM instructions, regardless of the any security problems in the code itself, or even outright malicious code. It just can't do it. More generally for VMs, there are secure VMs which provide a mathematical proof that the code will, for instance, observe memory safety. Such a proof is much better than ring-level protection, because : 1) You can verify the proof. Good luck verifying the hardware implementation of ring-level security in processors 2) It doesn't take any resources at runtime 3) the proof can be verified at code load time, so insecure code (accidentally insecure or otherwise) just doesn't start executing, ever 4) It doesn't allow for manufacturers to hide "secure coprocessors" or any other bullshit like that

dleslie 8y ago

RowHammer most certainly works in a VM: https://github.com/IAIK/rowhammerjs https://github.com/IAIK/rowhammerjs

candiodari 8y ago

> since the code is now in ring 0, you get all the consequences of that No you don't. Because WASM does not provide many of the facilities that real assembly provides. So, for instance, there is no way to stack-smash using WASM instructions, regardless of the any security problems in the code itself, or even outright malicious code. It just can't do it. More generally for VMs, there are secure VMs which provide a mathematical proof that the code will, for instance, observe memory safety. Such a proof is much better than ring-level protection, because : 1) You can verify the proof. Good luck verifying the hardware implementation of ring-level security in processors 2) It doesn't take any resources at runtime 3) the proof can be verified at code load time, so insecure code (accidentally insecure or otherwise) just doesn't start executing, ever 4) It doesn't allow for manufacturers to hide "secure coprocessors" or any other bullshit like that