Finding and Preventing Bugs in JavaScript Bindings

JavaScript, like many high-level languages, relies on runtime systems written in low-level C and C++. For example, the Node.js runtime system gives JavaScript code access to the underlying file system, networking, and I/O by implementing utility functions in C++. Since C++'s type system, memory...

Ausführliche Beschreibung

Gespeichert in:
Bibliographische Detailangaben
Veröffentlicht in:Proceedings - IEEE Symposium on Security and Privacy S. 559 - 578
Hauptverfasser: Brown, Fraser, Narayan, Shravan, Wahby, Riad S., Engler, Dawson, Jhala, Ranjit, Stefan, Deian
Format: Tagungsbericht
Sprache:Englisch
Veröffentlicht: IEEE 01.05.2017
Schlagworte:
C++ languages
Computer bugs
Engines
Indexes
Runtime
Security
ISSN:2375-1207
Online-Zugang:Volltext
Tags: Tag hinzufügen
Keine Tags, Fügen Sie den ersten Tag hinzu!
Beschreibung
Zusammenfassung:JavaScript, like many high-level languages, relies on runtime systems written in low-level C and C++. For example, the Node.js runtime system gives JavaScript code access to the underlying file system, networking, and I/O by implementing utility functions in C++. Since C++'s type system, memory model, and execution model differ significantly from JavaScript's, JavaScript code must call these runtime functions via intermediate binding layer code that translates type, state, and failure between the two languages. Unfortunately, binding code isboth hard to avoid and hard to get right. This paper describes several types of exploitable errors that binding code creates, and develops both a suite of easily-to-build static checkers to detect such errors and a backwards-compatible, low-overhead API to prevent them. We show that binding flaws are a serious security problem byusing our checkers to craft 81 proof-of-concept exploits for security flaws in the binding layers of the Node.js and Chrome, runtime systems that support hundreds of millions of users. As one practical measure of binding bug severity, we were awarded 6,000 in bounties for just two Chrome bug reports.
ISSN:2375-1207
DOI:10.1109/SP.2017.68