Running Wasmtime in Hardware-Isolated Microenvironments
summary
Demonstrates two concrete integrations: a no-std Wasmtime running as a bare-metal guest inside Hyperlight-Wasm and a Hyperlight + microkernel setup (Nanvix/Unikraft) that gives syscalls with kernel-level filtering and Rust std support. Reproduces CVE 2023-26489 (Wasmtime 0.37–6.0) that bypasses Wasmtime’s 6 GB reservation and shows a patched 6.0.1 stops the exploit; wrapping Wasmtime in Hyperlight makes the guest crash instead of leaking host secrets. Live cold-start numbers: about 3 ms baseline, 18–24 ms Hyperlight-Wasm, 60–80 ms Unikraft/Nanvix.
AI-written summary · about
chapters (17)
- 0:00Hyperlight and Wasmtime isolation
- 1:08What is Hyperlight
- 2:09Hardening Wasmtime sandboxes
- 3:13Wasmtime memory protection
- 4:38CVE 2023-26489 explained
- 7:53Memory escape demo
- 10:23Patched Wasmtime verification
- 11:05Hyperlight defense in depth
- 12:30Wasmtime in Hyperlight Unikraft
- 13:13Hyperlight isolation demo
- 15:00Running Wasmtime in Hyperlight
- 16:23Benchmarking approaches
- 18:30Hyperlight flavors
- 20:13WASI workloads demo
- 23:24Speed versus isolation trade-offs
- 24:27Key takeaways
- 25:30Q&A
related talks
28mSecurity and Correctness in Wasmtime
26mSyscall Me by Your Name: Sandboxing Wasm Programs
36mSandboxing Your Sandbox: Leveraging Hypervisors for WebAssembly Security
29mWASM in the Kernel: evolving threat detection at runtime
55mUsing WebAssembly to run, extend, and secure your .NET application
38mWebAssembly beyond the browser
40mSmarter Operating Systems Will Use Wasm - The Coming OS Revolution
53mWASM Wonders Decoding WebAssembly's Inner Workings