820180 - Isolate JS pseudorandom number generator state per compartment

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jason Orendorff [:jorendorff]]

Since the Math.random() algorithm is pretty trivial, the PRNG state is stored in JSContext, and contexts are shared across domains, a web page can theoretically observe how many times Math.random has been called in all other domains and even in chrome code.

This side channel is long-known, and it's not terribly sensitive information, but what the heck -- it's silly to be sharing this state, and super easy to fix.

(I believe Mark S. Miller proposed a change to ES6 to require each global to have its own PRNG stream. It isn't in the latest draft.)

Comment 1

[Jason Orendorff [:jorendorff]]

Attachment: v1

Comment 2

[Luke Wagner [:luke]]

Comment on attachment 690611 [details] [diff] [review]
v1

Makes sense.  I would not be opposed if you renamed js_InitRandom to be a JSRuntime:: member of js:: non-member function.

Comment 3

[Jason Orendorff [:jorendorff]]

This bounced because there's Windows-only code in js/src/assembler/jit randomly using random_next, whose signature this patch changes.

Trying again.

Comment 4

[Jason Orendorff [:jorendorff]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/7702047b003f

Comment 5

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/7702047b003f

Comment 6

[Jesse Ruderman]

Didn't we fix this twice already, in bug 475585 and bug 577512? :/

Comment 7

[Jeff Walden [:Waldo]]

Those fixes were not the same as this one.  We didn't have anything like a compartment to store randomness in until recently, ish.  Those fixes just chose the next best thing.  Admittedly, the summaries/comments there probably didn't make that as clear as they could have.