Put Your Memory in Order: Efficient Domain-based Memory Isolation for WASM Applications

Memory corruption vulnerabilities can have more serious consequences in WebAssembly than in native applications. Therefore, we present PKUWA, the first WebAssembly runtime with memory isolation. Our insight is to use MPK hardware for efficient memory protection in WebAssembly. However, MPK and WebAssembly have different memory models: MPK protects virtual memory pages, while WebAssembly uses linear memory that has no pages. Mapping MPK APIs to WebAssembly causes memory bloating and low running efficiency. To solve this, we propose Domain Isolated Linear Memory (DILM), which protects linear memory at function-level granularity. We implemented DILM into the official WebAssembly runtime to build PKUWA. Our evaluation shows that PKUWA can prevent memory corruption in real projects with a 1.77% average overhead and negligible memory cost.