WebAssembly enables complex applications originally developed in low-level programming languages such as C or Rust to be compiled into a portable binary format that can run in all modern browsers. However, vulnerabilities in the original source code can also be carried over into the resulting WebAssembly module.

Although WebAssembly provides mechanisms that largely protect control flow, its "linear memory", where a module's data is stored, is only partially protected. In particular, a module's memory layout is deterministic: each time the module is executed, its every data object is located at the same position in linear memory. This predictability facilitates so-called data-only attacks, in which data is deliberately manipulated to influence a program's behavior without directly altering its control flow.

Operating systems make such attacks on native programs more difficult, in part through Address Space Layout Randomization (ASLR), which places memory regions at random addresses each time a program starts. However, this approach cannot be directly applied to WebAssembly because its linear memory is organized differently and does not provide the same abstractions required by ASLR, such as virtual memory.

To address this limitation, we developed WASLR, a fine-grained memory randomization approach specifically designed for WebAssembly. WASLR changes the memory layout on each execution by randomizing individual memory objects rather than entire memory regions. This makes it harder for attackers to reliably predict the locations of individual objects, even if they already leaked a memory address within the same region.

The work was presented at the RAID conference in Lancaster in early October.

Link to publication: TBD