Exploring and Exploiting the Resource Isolation Attack Surface of WebAssembly Containers

Zhaofeng Yu, Dongyang Zhan, Lin Ye, Haining Yu, Hongli Zhang, Zhihong Tian

34th USENIX Security Symposium · Day 1

This article delves into the critical security vulnerabilities present in WebAssembly (Wasm) runtimes, specifically focusing on their **resource isolation attack surface**. Authored by Zhaofeng Yu and a team of researchers from Harbin Institute of Technology and Guangzhou University, the paper highlights that despite Wasm's design for secure sandboxing and its reputation as a more secure container technology than Docker, its current implementations in widely used runtimes like Wasmtime and Wasmer are susceptible to resource exhaustion attacks. These attacks, leveraging the **WebAssembly System Interfaces (WASI)** and **WASIX** extensions, can severely degrade host system performance and disrupt other Wasm instances.

AI review

Solid systems security work that systematically maps a real attack surface nobody else had properly explored. The Rust-specific static analysis tooling is genuinely useful, and the exploitation strategies are practical. Not paradigm-shifting, but fills a gap that needed filling.