Lost in the Pages: WebAssembly Code Recovery Through SEV-SNP’s Exposed Address Space

WebAssembly (Wasm) has emerged as a widely used technology for distributed computing across different platforms. The platform independence offered by Wasm makes it an attractive solution for many different applications that can run on disparate infrastructures. In addition, Trusted Execution Environments are offered in many computing infrastructures, which allow running security-sensitive Wasm workloads independent of the specific platforms offered. However, recent work has shown that Wasm binaries are more sensitive to code confidentiality attacks than native binaries. These attacks have previously only been performed on Intel SGX. In this paper, we take this a step further by introducing a new Wasm code-confidentiality attack that exploits exposed address-space information in AMD SEV-SNP. Our attack enables the extraction of crucial execution features which, when combined with additional side-channels, allow us to obtain more than 70% of the code with high reliability when executed in an interpreter, and more than 80% when compiling a Wasm module. This is a considerably larger amount than that obtained so far by single-stepping Intel SGX, where upwards to 50% of the code could be obtained.