WasmSepa: Effectively Protecting WebAssembly Through Privilege Separation

WebAssembly (Wasm) is an emerging binary instruction set architecture designed for secure binary program execution and is increasingly deployed across various security-critical domains including edge computing and smart contracts. However, despite its security-oriented design, Wasm remains vulnerable due to its support for compiling functions and APIs from unsafe languages and the lack of effective protection mechanisms during compilation. These issues undermine Wasm's security guarantees. In this paper, we present WasmSepa, the first approach for effectively securing Wasm through privilege separation, by isolating Wasm binaries from functions written in unsafe languages. Our key insight is that, since Wasm incorporates several security features, we should execute Wasm binaries and libraries from unsafe languages in separate processes to enforce strong privilege separation. Specifically, we first identify potential unsafe function calls during Wasm binary generation. We then wrap these unsafe functions by utilizing remote procedure calls (RPC). We finally enable inter-process communication between safe Wasm binaries and unsafe functions via RPC. We implement a software prototype of WasmSepa and conduct extensive experiments to evaluate its effectiveness, usefulness, and overhead using micro and real-world benchmarks. Experimental results demonstrate that WasmSepa effectively protects Wasm linear memory from unsafe code while incurring an average code size increase of 48 % and an execution time overhead of $7.63 \times$.