3 ms·

JIT and Bytecode are two sides of the same coin, in my head. JIT also uses bytecode in some languages like Java.

deleted 2y ago
[deleted]
fwsgonzo 2y ago
It's much worse than that because of the complexity around JITs, behavior of hardware and speculative execution. Proper sandboxing is really hard, and I suspect that if people really want security they would disable JIT in general. Even simple ones like pcre2. Personally I have disabled Firefox's JIT (I believe it's called ion in the settings, but correct me if I misremember) for a few years now. I've never had any trouble with any websites so far. It's not instant loading, but it's close enough. ... but I don't know if I would lump bytecode with JIT. Bytecodes don't need or use RWX execute segments, for example. Lots of your favorite JITs do, for speed.
nanidin 2y ago
In this case someone generated malicious bytecode that the JIT compiler would not generate. I would argue JIT is dangerous because it requires dynamic memory without the NX bit set, so if you manage to smash the stack (find an exploit) you can execute arbitrary code easily (leverage the exploit). That's a different dangerous than running malicious bytecode.
- colejohnson66 2y ago
  JITs can still function with an NX bit; You just have to halt execution to modify it.
- axoltl 2y ago
  This doesn't generally apply but Apple has a bunch of hardening in place that means you don't just have an RWX mapping hanging around: https://developer.apple.com/documentation/browserenginekit/protecting-code-compiled-just-in-time https://developer.apple.com/documentation/browserenginekit/p... On top of that they're working on (I haven't checked in a bit) having the JIT compiler be entirely Out-Of-Process. I don't think a lot has been written about that publicly but there's a few breadcrumbs like https://developer.apple.com/documentation/kernel/oop_jit_conversion https://developer.apple.com/documentation/kernel/oop_jit_con...
pjmlp 2y ago
All modern compilers use bytecode, in one form or the other.

deleted 2y ago

[deleted]

It's much worse than that because of the complexity around JITs, behavior of hardware and speculative execution. Proper sandboxing is really hard, and I suspect that if people really want security they would disable JIT in general. Even simple ones like pcre2. Personally I have disabled Firefox's JIT (I believe it's called ion in the settings, but correct me if I misremember) for a few years now. I've never had any trouble with any websites so far. It's not instant loading, but it's close enough. ... but I don't know if I would lump bytecode with JIT. Bytecodes don't need or use RWX execute segments, for example. Lots of your favorite JITs do, for speed.

nanidin 2y ago

In this case someone generated malicious bytecode that the JIT compiler would not generate. I would argue JIT is dangerous because it requires dynamic memory without the NX bit set, so if you manage to smash the stack (find an exploit) you can execute arbitrary code easily (leverage the exploit). That's a different dangerous than running malicious bytecode.

colejohnson66 2y ago
JITs can still function with an NX bit; You just have to halt execution to modify it.
axoltl 2y ago
This doesn't generally apply but Apple has a bunch of hardening in place that means you don't just have an RWX mapping hanging around: https://developer.apple.com/documentation/browserenginekit/protecting-code-compiled-just-in-time https://developer.apple.com/documentation/browserenginekit/p... On top of that they're working on (I haven't checked in a bit) having the JIT compiler be entirely Out-Of-Process. I don't think a lot has been written about that publicly but there's a few breadcrumbs like https://developer.apple.com/documentation/kernel/oop_jit_conversion https://developer.apple.com/documentation/kernel/oop_jit_con...

pjmlp 2y ago

All modern compilers use bytecode, in one form or the other.