3 ms·
“V8 exploits typically follow a similar pattern: an initial bug leads to memory corruption…” naturally gets me wondering about Firefox and Rust. Is it measurab
by Waterluvian 3y ago
“V8 exploits typically follow a similar pattern: an initial bug leads to memory corruption…”
naturally gets me wondering about Firefox and Rust. Is it measurably helping eliminate this class of issue? Too soon to tell?
- treyd 3y agoWith jitting runtimes like V8 often the root cause of the exploit is a logical error in code generation that leads to the sandboxed code to get a read/write gadget into memory outside the sandbox. Rewriting the jit in Rust might help eliminate those kinds of issues, but it's still entirely possible they would happen.
- hovav 3y agoA JIT is a machine for turning logic bugs into memory unsafety. Rewriting a JIT in Rust won't eliminate logic bugs and won't guarantee memory safety for the binary output of the JIT (as distinct from the JIT implementation itself).
- infogulch 3y agoAgreed. But the way you put it makes me wonder how many memory safety vulns have been found in JIT implementations (not the machine code they output).
- nextaccountic 3y agoOkay, but in this case software verification like with Coq or F* could help
- hovav 3y agoYes! See, e.g., Fraser Brown et al., "Towards a Verified Range Analysis for JavaScript JITs," in proc. PLDI 2020, https://www.cs.utexas.edu/~hovav/dist/vera.pdf https://www.cs.utexas.edu/~hovav/dist/vera.pdf
- paulddraper 3y ago> Is it measurably helping eliminate this class of issue? No. A JIT is a compiler. The compiler itself would be memory-safe, but not the compiled output.
- kevingadd 3y agoThe JS runtime and JIT are still entirely C++ and assembly, afaik. I'm not sure we'd ever see them migrate Spidermonkey to Rust.