Researchers from Stanford University, the University of California, San Diego, and the University of Texas at Austin toolkit , which can serve as an additional layer of isolation to block vulnerabilities in function libraries. RLBox aims to address the security issue of untrustworthy third-party libraries that are beyond the developers' control, but vulnerabilities in which can compromise the main project.
Mozilla to implement RLBox in Linux builds of Firefox 74 and macOS builds of Firefox 75 to isolate the execution of the library , responsible for rendering fonts. Note that RLBox is not specific to Firefox and can be used to isolate any libraries in arbitrary projects. RLBox under the MIT license. Currently, RLBox supports operation on Linux and macOS platforms, with Windows support expected later.
of RLBox operates by compiling C/C++ code of the isolating library into low-level intermediate code WebAssembly, which is then packaged as a WebAssembly module with permissions tied only to that module (for example, a library for string processing will not be able to open a network socket or file). The transformation of C/C++ code into WebAssembly is done using .
For direct execution, the WebAssembly module is compiled into machine code using the compiler and executes in a separate 'nano-process', isolated from the rest of the application's memory. The Lucet compiler is based on the same code as the JIT engine , used in Firefox for executing WebAssembly.
The compiled module operates in a separate memory area and does not have access to the rest of the address space. In the event of a vulnerability exploitation in the library, an attacker will be constrained and unable to access the memory areas of the main process or transfer control outside the isolated environment.
Developers are provided with a high-level , which allows calling library functions in an isolated mode. WebAssembly handlers require almost no additional resources, and interacting with them is not significantly slower than calling regular functions (library functions are executed as native code, with overhead occurring only during data copying and validation when interacting with the isolated environment). Functions from the isolated library cannot be called directly, and to refer to them, one must use
the invoke_sandbox_function() layer.
In turn, if external functions need to be called from the library, those functions must be explicitly defined using the register_callback method (by default, RLBox provides access to functions ). To ensure safe memory operation (memory safety), isolation of code execution is not enough; it is also necessary to ensure verification of returned data streams.
Values formed in the isolated environment are marked as untrustworthy, limited using , and require and copying into the application's memory.
Without verification, attempting to use tainted data in a context requiring regular data (and vice versa) results in compilation errors. Small function arguments, return values, and structures are passed through copying between the process memory and the isolated environment memory. For larger data sets, memory is allocated in the isolated environment, and a direct pointer 'sandbox-reference' is returned to the main process.
Source: opennet.ru
