JavaScript Engine Security via Virtual Machine Pointer Poisoning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern JavaScript engines, which use Just-In-Time (JIT) compilation for rapid execution of untrusted code, are vulnerable to attacks that bypass operating system or hardware protection, allowing attackers to gain read access to secret memory information through speculative execution exploits.
Innovation Solution
Implementing virtual machine (VM) based vulnerability mitigation techniques, including pointer poisoning, dynamic poisoning, live state poisoning, object distancing, and random jumping, to harden web content frameworks and JavaScript Engines against attacks by modifying and securing pointers, type checks, and branch predictions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If JIT compilation is used to execute untrusted code quickly, then execution speed is improved, but security vulnerability increases
Solution Approach 1:
The patent introduces a virtual machine as an intermediary layer between the untrusted JavaScript code and the host system. The virtual machine executes code in an isolated environment with controlled access to system resources, preventing direct exploitation of speculative execution vulnerabilities while maintaining execution performance through optimized virtualization techniques.
Solution Approach 2:
The patent segments the execution environment into separate virtual machine instances, each with its own memory space and execution context. This segmentation isolates potential security vulnerabilities within individual virtual machine instances, preventing them from affecting the host system or other instances while allowing fast execution through efficient inter-instance communication.
2Reliability
If pointer poisoning and dynamic poisoning are applied to secure pointers, then security is improved, but device complexity increases
Solution Approach 1:
The patent modifies pointer parameters by XORing them with secret keys before dereferencing, transforming normal pointer operations into secured operations. This parameter transformation approach provides strong security without requiring fundamental changes to the pointer mechanism, maintaining simplicity while enhancing protection against speculative execution attacks.
Solution Approach 2:
The virtual machine automatically applies poisoning keys to pointers during execution without external intervention. The system self-manages security by injecting and managing poisoning keys within the virtual machine environment, eliminating the need for complex external security infrastructure while maintaining robust protection.
3Reliability
If object distancing and random jumping are implemented to prevent attacks, then security is improved, but productivity decreases
Solution Approach 1:
The patent implements random jumping by periodically shuffling the execution order of bytecode instructions within the virtual machine. This periodic reordering prevents attackers from predicting execution paths while maintaining average execution performance, as the overhead is distributed across many small operations rather than requiring complete execution restarts.
Solution Approach 2:
The patent makes the execution environment dynamic by allowing the virtual machine to adaptively reorder instructions and adjust execution paths based on runtime conditions. This dynamic behavior prevents deterministic attack patterns while optimizing performance by executing common paths efficiently, balancing security and productivity through flexible execution control.
Data Source
AI summary
Embodiments described herein provide for virtual machine (VM) based exploit mitigation techniques that can be used to harden web content frameworks and JavaScript Engines. Some embodiments described herein are also generally applicable to other system frameworks, libraries, and program code that executes on a processor that is vulnerable to an attack using a security exploit. Program code that implements the techniques described herein can prevent the use of security exploit attacks to bypass security properties within the program code.