bytecodealliance / bytecodealliance/wasmtime

wasi-common: high resolution timers can be a security or fingerprinting risk in some contexts

Open
#2,125 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Rust
Stars
18.6k
Forks
1.8k
Avg merge
1d 18h
Merged PRs (30d)
126

Description

As we know, in the browser space there are various concerns around speculative execution attacks (Spectre etc) that are mitigated in part by reducing the precision of timers available to untrusted code.

Presently, `wasi-common`'s timer APIs provide resolution as high as the underlying OS provides.

I propose implementing a configurable timing-precision-reduced mode to the `wasi-common` crate. The precision available will configured as part of the `WasiCtxBuilder`. Full resolution will still be available to users who want it, but one open question is whether the default should be full resolution or some reduced value. Different browsers have set different default precision levels - FF and Edge 20us, Chrome 100us, Safari 1ms according to https://github.com/w3c/hr-time/issues/56.

The following well-commented implementation in Firefox looks like a good reference on how clamping and jitter should work: https://searchfox.org/mozilla-central/source/toolkit/components/resistfingerprinting/nsRFPService.cpp#446

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.