Skip to content

Commit 8976ac0

Browse files
lum1n0uslum1n0us
committed
Enhance security guidelines for identifying vulnerabilities
It incudes a tiered-support-list
1 parent 6c3f6fd commit 8976ac0

3 files changed

Lines changed: 232 additions & 6 deletions

File tree

‎doc/build_wamr.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,8 @@ add_library(vmlib ${WAMR_RUNTIME_LIB_SOURCE})
2020

2121
The script `runtime_lib.cmake` defines a number of variables for configuring the WAMR runtime features. You can set these variables in your CMakeList.txt or pass the configurations from cmake command line.
2222

23+
Please refer to [a full list of configuration options](./tired_support.md#appendix-all-compilation-flags).
24+
2325
### **Configure platform and architecture**
2426

2527
- **WAMR_BUILD_PLATFORM**: set the target platform. It can be set to any platform name (folder name) under folder [core/shared/platform](../core/shared/platform).

‎doc/security_need_to_know.md‎

Lines changed: 32 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -15,19 +15,45 @@ It is commonly stated that a security issue is an issue that:
1515

1616
Given that WASI is a set of Capability-based APIs, all unauthorized actions are not supposed to happen. Most of the above security concerns can be alleviated. What remains for us is to ensure that the execution of Wasm modules is secure. In other words, do not compromise the sandbox. Unless it is explicitly disabled beforehand.
1717

18-
Thus, we share most of the criteria for judging security issues with [the Bytecode Alliance](https://github.com/bytecodealliance/rfcs/blob/main/accepted/what-is-considered-a-security-bug.md#definition).
18+
### Is this bug considered a security vulnerability?
19+
20+
For someone who finds a problem, if a bug **results in crash or hang**, please treat it as a security problem and report it to a security advisor. The maintainer will look into it and change its category if needed. It is better safe than sorry.
21+
22+
If the author of an issue(results in crash or hang) can go through the following checklist and answer all questions with "No", it is fine to mark it as a regular bug. If not, please report it as a security issue.
23+
24+
---
25+
26+
For those maintainers, please use the following guidelines to determine if a bug or advisory is a security issue:
27+
28+
Only bugs that affect [tier A platforms or features](./tired_support.md) should be considered.
29+
30+
Actions that differ from Wasm rules (like calculating wrong values) are not seen as security issues as long as they stay within the sandbox.
31+
32+
As embedded code, trusts inputs from the guest. By default, APIs and CLIs are following the principle of **caller guarantee**. If the caller provides incorrect parameters, it is not a security issue. For example, if a user passes an invalid file descriptor to `fd_read`, it is not a security issue.
33+
34+
While .aot files are trusted, .wasm files are not. Any unexpected behavior caused by a .wasm file is not a security issue. For example, if a .wasm file causes a runtime crash or hang, it is a security issue. However, if the same .wasm file causes a crash or hang when converted to an .aot file, it is not a security issue.
35+
36+
A denial-of-service (DoS) attack is a cyberattack that aims to make a computer or network resource unavailable to its users. If the service (runtime in this case) can recover and start another module or run another function within the same instance, it is not considered unavailable, and thus not a Denial of Service (DoS).
37+
38+
Another type of execution problem we usually do not classify as a security one is if it is caused by an infinite loop or incorrect recursive function call chain.
1939

2040
> [!NOTE]
21-
> keep updating this document as the project evolves.
41+
> need a diagram or a cheat sheet for quick reference eventually.
42+
43+
### When a maintainer identify a problem that should be classified as a security vulnerability
44+
45+
Once a maintainer realizes an issue or PR describes a real or possible security vulnerability, act quickly to minimize exposure. Do not share technical details publicly on the issue or PR anymore. Maintainers should:
46+
47+
- Close or edit the public discussion. Thank the person who reported it and explain that security-related issues should go through the Security Advisory process. Close the public issue or pull request as soon as possible to prevent further public sharing. If details have already been shared, consider editing or asking GitHub staff to remove sensitive content.
48+
49+
- Create a Security Advisory. Invite the reporter to join as a collaborator or reporter. If the reporter is uncomfortable using GitHub Security Advisories, offer another private communication method, such as email.
50+
51+
- Follow the guidelines in [the security issue runbook](./security_issue_runbook.md) for the next steps.
2252

2353
## reporting a security issue
2454

2555
Follow the [same guidelines](https://bytecodealliance.org/security) as other projects within the Bytecode Alliance.
2656

2757
## managing a security issue
2858

29-
Before reporting an issue, particularly one related to crashing, consult [the cheat sheet](https://github.com/bytecodealliance/rfcs/blob/main/accepted/what-is-considered-a-security-bug.md#cheat-sheet-is-this-bug-considered-a-security-vulnerability), _Report a security vulnerability_ if it qualifies.
30-
31-
Upon receiving an issue, thoroughly review [the cheat sheet](https://github.com/bytecodealliance/rfcs/blob/main/accepted/what-is-considered-a-security-bug.md#cheat-sheet-is-this-bug-considered-a-security-vulnerability) to assess and _Report a security vulnerability_ if the issue is indeed a security vulnerability.
32-
3359
Once a security issue is confirmed, please refer to [the runbook](./security_issue_runbook.md) for the subsequent steps to take.

‎doc/tiered_suppor.md‎

Lines changed: 198 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,198 @@
1+
# Tiered Supported
2+
3+
**Tier definitions**
4+
5+
- **A — Production Ready:** fully tested and stable.
6+
- **B — Almost Production Ready:** partially tested; close to production.
7+
- **C — Experimental / Not Production Ready:** unfinished or volatile.
8+
9+
## Architecture Support
10+
11+
| Architecture | Tier |
12+
| ------------ | ----- |
13+
| **x86-64** | **A** |
14+
| **x86-32** | **A** |
15+
| AArch64 | B |
16+
| ARC | B[^1] |
17+
| ARM | B |
18+
| RISCV32 | B |
19+
| RISCV64 | B |
20+
| THUMB | B |
21+
| MIPS | C |
22+
| XTENSA | C |
23+
24+
[^1]: will upgrade to **A** after further testing and validation.
25+
26+
## OS / Platform Support
27+
28+
| Platform | Tier |
29+
| ------------------ | ----- |
30+
| **NuttX** | **A** |
31+
| **Ubuntu** | **A** |
32+
| Android | B |
33+
| macOS | B |
34+
| Windows | B |
35+
| Zephyr | B[^2] |
36+
| AliOS-Things | C |
37+
| Cosmopolitan | C |
38+
| ESP-IDF (FreeRTOS) | C |
39+
| FreeBSD | C |
40+
| iOS | C |
41+
| RT-Thread | C |
42+
| RIOT | C |
43+
| VxWorks | C |
44+
45+
[^2]: will upgrade to **A** after further testing and validation.
46+
47+
## WebAssembly Proposal Support
48+
49+
> Defaults below reflect the sample build configuration you provided (e.g., `WAMR_BUILD_*` values), not necessarily the release bundle. “Always-on” items are part of WAMR’s baseline.
50+
51+
| WASM Proposal / Extension | Tier | Default |
52+
| -------------------------------------- | ----------- | ------- |
53+
| **Bulk Memory** | A | **On** |
54+
| **Extended Constant Expressions** | A | Off |
55+
| **Import/Export of Mutable Globals** | A | **On** |
56+
| **Memory64** | A | Off |
57+
| **Multi-value** | A | **On** |
58+
| **Non-trapping float-to-int** | A | **On** |
59+
| **Reference Types** | A | **On** |
60+
| **Shared Memory (Threads)** | A | Off |
61+
| **SIMD (128-bit)** | A | **On** |
62+
| **Sign-extension Operators** | A | **On** |
63+
| GC (Garbage Collection) | B | Off |
64+
| Stringref | B | Off |
65+
| Tail Calls | B | Off |
66+
| Multi-memory | C | Off |
67+
| Legacy Exception Handling | C | Off |
68+
| Branch Hinting | Unsupported | |
69+
| Custom Annotation Syntax (text format) | Unsupported | |
70+
| Exception Handling (new spec) | Unsupported | |
71+
| JS String Builtins | Unsupported | |
72+
| Relaxed SIMD | Unsupported | |
73+
74+
# WAMR-Specific Feature Support
75+
76+
> Defaults below mirror your sample build output (e.g., “enabled/disabled” lines) and common WAMR options.
77+
78+
| WAMR Feature | Tier | Default |
79+
| --------------------------------- | ---- | ------- |
80+
| **AoT (wamrc)** | A | **On** |
81+
| **AOT intrinsics** | A | **On** |
82+
| **Fast Interpreter** | A | **Off** |
83+
| **Interpreter (classic)** | A | **On** |
84+
| **Libc builtin** | A | **On** |
85+
| **Libc WASI** | A | **On** |
86+
| **Quick AOT/JIT entries** | A | **On** |
87+
| **Shrunk memory** | A | **On** |
88+
| **Wakeup of blocking operations** | A | **On** |
89+
| **WASM C API** | A | **On** |
90+
| Fast JIT | B | Off |
91+
| LLVM ORC JIT | B | Off |
92+
| Memory profiling | B | Off |
93+
| Module instance context[^7] | B | On |
94+
| Multi-module | B | Off |
95+
| Perf profiling | B | Off |
96+
| Pthread | B | Off |
97+
| Shared heap | B | Off |
98+
| WASI threads | B | Off |
99+
| WASI-NN (neural network APIs) | B | Off |
100+
| Debug Interpreter | B | Off |
101+
| Debug AOT | C | Off |
102+
| Tier-up (Fast JIT → LLVM JIT) | C | Off |
103+
104+
---
105+
106+
# Appendix: All compilation flags
107+
108+
| Compilation flags | Tiered | Default | on Ubuntu |
109+
| ------------------------------------------- | ------ | ------- | --------- |
110+
| WAMR_APP_THREAD_STACK_SIZE_MAX | B | ND[^3] | |
111+
| WAMR_BH_LOG | B | ND | |
112+
| WAMR_BH_VPRINTF | B | ND | |
113+
| WAMR_BUILD_ALLOC_WITH_USAGE | B | ND | |
114+
| WAMR_BUILD_ALLOC_WITH_USER_DATA | B | ND | |
115+
| WAMR_BUILD_AOT | A | ND | 1 |
116+
| WAMR_BUILD_AOT_INTRINSICS | A | 1[^4] | |
117+
| WAMR_BUILD_AOT_STACK_FRAME | A | ND | |
118+
| WAMR_BUILD_AOT_VALIDATOR | B | ND | |
119+
| WAMR_BUILD_BULK_MEMORY | A | 1 | |
120+
| WAMR_BUILD_COPY_CALL_STACK | B | ND | |
121+
| WAMR_BUILD_CUSTOM_NAME_SECTION | B | ND | |
122+
| WAMR_BUILD_DEBUG_AOT | C | ND | |
123+
| WAMR_BUILD_DEBUG_INTERP | B | ND | |
124+
| WAMR_BUILD_DUMP_CALL_STACK | B | ND | |
125+
| WAMR_BUILD_DYNAMIC_AOT_DEBUG | C | ND | |
126+
| WAMR_BUILD_EXCE_HANDLING | C | 0 | |
127+
| WAMR_BUILD_EXTENDED_CONST_EXPR | A | 0 | |
128+
| WAMR_BUILD_FAST_INTERP | A | ND | 1 |
129+
| WAMR_BUILD_FAST_JIT | B | ND | |
130+
| WAMR_BUILD_FAST_JIT_DUMP | B | ND | |
131+
| WAMR_BUILD_GC | B | 0 | |
132+
| WAMR_BUILD_GC_HEAP_VERIFY | B | ND | |
133+
| WAMR_BUILD_GLOBAL_HEAP_POOL | A | ND | |
134+
| WAMR_BUILD_GLOBAL_HEAP_SIZE | A | ND | |
135+
| WAMR_BUILD_INSTRUCTION_METERING | C | ND | |
136+
| WAMR_BUILD_INTERP | A | ND | 1 |
137+
| WAMR_BUILD_INVOKE_NATIVE_GENERAL | B | ND | |
138+
| WAMR_BUILD_JIT | B | ND | |
139+
| WAMR_BUILD_LAZY_JIT | B | 1[^5] | |
140+
| WAMR_BUILD_LIBC_BUILTIN | A | ND | 1 |
141+
| WAMR_BUILD_LIBC_EMCC | C | ND | |
142+
| WAMR_BUILD_LIBC_UVWASI | C | ND | |
143+
| WAMR_BUILD_LIBC_WASI | A | ND | 1 |
144+
| WAMR_BUILD_LIB_PTHREAD | B | ND | |
145+
| WAMR_BUILD_LIB_PTHREAD_SEMAPHORE | B | ND | |
146+
| WAMR_BUILD_LIB_RATS | C | ND | |
147+
| WAMR_BUILD_LIB_WASI_THREADS | B | ND | |
148+
| WAMR_BUILD_LINUX_PERF | B | ND | |
149+
| WAMR_BUILD_LOAD_CUSTOM_SECTION | A | ND | |
150+
| WAMR_BUILD_MEMORY64 | A | 0 | |
151+
| WAMR_BUILD_MEMORY_PROFILING | B | ND | |
152+
| WAMR_BUILD_MINI_LOADER | B | ND | |
153+
| WAMR_BUILD_MODULE_INST_CONTEXT | B | ND | 1 |
154+
| WAMR_BUILD_MULTI_MEMORY | C | 0 | |
155+
| WAMR_BUILD_MULTI_MODULE | B | ND | |
156+
| WAMR_BUILD_PERF_PROFILING | B | ND | |
157+
| WAMR_BUILD_PLATFORM | - | ND | linux |
158+
| WAMR_BUILD_QUICK_AOT_ENTRY | A | 1[^6] | |
159+
| WAMR_BUILD_REF_TYPES | A | ND | 1 |
160+
| WAMR_BUILD_SANITIZER | B | ND | |
161+
| WAMR_BUILD_SGX_IPFS | C | ND | |
162+
| WAMR_BUILD_SHARED_HEAP | A | ND | |
163+
| WAMR_BUILD_SHARED_MEMORY | A | 0 | 1 |
164+
| WAMR_BUILD_SHRUNK_MEMORY | A | ND | 1 |
165+
| WAMR_BUILD_SIMD | A | ND | 1 |
166+
| WAMR_BUILD_SIMDE | A | ND | 1 |
167+
| WAMR_BUILD_SPEC_TEST | A | ND | |
168+
| WAMR_BUILD_STACK_GUARD_SIZE | B | ND | |
169+
| WAMR_BUILD_STATIC_PGO | B | ND | |
170+
| WAMR_BUILD_STRINGREF | B | 0 | |
171+
| WAMR_BUILD_TAIL_CALL | A | 0 | 1 |
172+
| WAMR_BUILD_TARGET | - | ND | X86-64 |
173+
| WAMR_BUILD_THREAD_MGR | A | ND | |
174+
| WAMR_BUILD_WAMR_COMPILER | A | ND | |
175+
| WAMR_BUILD_WASI_EPHEMERAL_NN | B | ND | |
176+
| WAMR_BUILD_WASI_NN | B | ND | |
177+
| WAMR_BUILD_WASI_NN_ENABLE_EXTERNAL_DELEGATE | B | ND | |
178+
| WAMR_BUILD_WASI_NN_ENABLE_GPU | B | ND | |
179+
| WAMR_BUILD_WASI_NN_EXTERNAL_DELEGATE_PATH | B | ND | |
180+
| WAMR_BUILD_WASI_NN_LLAMACPP | B | ND | |
181+
| WAMR_BUILD_WASI_NN_ONNX | B | ND | |
182+
| WAMR_BUILD_WASI_NN_OPENVINO | B | ND | |
183+
| WAMR_BUILD_WASI_NN_TFLITE | B | ND | |
184+
| WAMR_BUILD_WASI_TEST | B | ND | |
185+
| WAMR_BUILD_WASM_CACHE | B | ND | |
186+
| WAMR_CONFIGURABLE_BOUNDS_CHECKS | C | ND | |
187+
| WAMR_DISABLE_APP_ENTRY | A | ND | |
188+
| WAMR_DISABLE_HW_BOUND_CHECK | A | ND | |
189+
| WAMR_DISABLE_STACK_HW_BOUND_CHECK | A | ND | |
190+
| WAMR_DISABLE_WAKEUP_BLOCKING_OP | B | ND | |
191+
| WAMR_DISABLE_WRITE_GS_BASE | B | ND | |
192+
| WAMR_TEST_GC | B | ND | |
193+
194+
[^3]: _ND_ represents _not defined_
195+
[^4]: active if `WAMR_BUILD_AOT` is 1
196+
[^5]: active if `WAMR_BUILD_FAST_JIT` or `WAMR_BUILD_JIT1` is 1
197+
[^6]: active if `WAMR_BUILD_AOT` or `WAMR_BUILD_JIT` is 1
198+
[^7]: required by Libc WASI

0 commit comments

Comments
 (0)