4 ms·
Considering that JS is JIT'd (and V8 has had JS based RCEs in the past), is there any reason to believe webasm is a significant security hole?
by cmeacham98 6y ago
Considering that JS is JIT'd (and V8 has had JS based RCEs in the past), is there any reason to believe webasm is a significant security hole?
- rasz 6y agoThis particular 0-day exploit goes thru webassembly. Other things I disable just in case is for example window.AudioContext = undefined saved me from 2 previous Chrome RCEs.
- astrange 6y agoSupposedly half of wasm deployments recently were malware like secret crypto miners. https://www.infoq.com/news/2019/10/WebAssembly-wasm-malicious-usage/ https://www.infoq.com/news/2019/10/WebAssembly-wasm-maliciou... It's probably tolerable to turn it off for now unless you know you need it.
- kevingadd 6y agoWebAssembly (and asm.js) add additional attack surface to V8, and multiple attacks (including this one) are not possible without that
- albntomat0 6y agoThe actual bug is in the Turbofan JIT, not WASM. Using WASM is the method de'jour for turning arbitrary read/write/object leak into RCE. Without WASM, the writer would have to use ROP/etc, but the primitives are still there. Check out this discussion by a bunch of the big names in the field, including Niklas B who was on the team that originally found this bug: https://twitter.com/spoofyroot/status/1379911787282243584 https://twitter.com/spoofyroot/status/1379911787282243584