一句话：揭示 WGSL 数据竞争可致内存安全护栏被优化删除的规范漏洞，并提出 SafeRace 内存安全保障 SMSG。
浏览器等不可信执行环境需要整条编译栈维持内存安全，而中间表示未必提供同等保证。本文发现 WebGPU 着色语言 WGSL 存在规范级漏洞：含数据竞争的程序在编译到中间表示后，优化编译器可以合法地移除内存安全护栏，形成随编译器演进随时可能爆发的“定时炸弹”。为此作者提出 SafeRace，给出跨 WGSL 执行栈的威胁评估与规范提案，核心是 SMSG（SafeRace Memory Safety Guarantee）：一是要求参与内存索引的程序切片无数据竞争，并用一个 WGSL 编译 pass 实现；二是对中间表示提出约束，限制数据竞争的影响范围使其无法波及无竞争切片。评估表明该漏洞在当前系统不可利用；对 21 条编译栈进行 81 小时 fuzzing 仅在一台疑似有缺陷的机器上发现违规；该 pass 在多个重要 WebGPU 应用上开销很小。研究还发现 Apple 与 AMD GPU 的内存隔离漏洞，以及 Firefox 预发布版中对 WGSL 的安全关键误编译。
In untrusted execution environments such as web browsers, code from remote sources is regularly executed. To harden these environments against attacks, constituent programming languages and their implementations must uphold certain safety properties, such as memory safety. These properties must be maintained across the entire compilation stack, which may include intermediate languages that do not provide the same safety guarantees. Any case where properties are not preserved could lead to a serious security vulnerability. In this work, we identify a specification vulnerability in the WebGPU Shading Language (WGSL) where code with data races can be compiled to intermediate representations in which an optimizing compiler could legitimately remove memory safety guardrails. To address this, we present SafeRace , a collection of threat assessments and specification proposals across the WGSL execution stack. While our threat assessment showed that this vulnerability does not appear to be exploitable on current systems, it creates a "ticking time bomb", especially as compilers in this area are rapidly evolving. Given this, we introduce the SafeRace Memory Safety Guarantee (SMSG), two components that preserve memory safety in the WGSL execution stack even in the presence of data races. The first component specifies that program slices contributing to memory indexing must be race free and is implemented via a compiler pass for WGSL programs. The second component is a requirement on intermediate representations that limits the effects of data races so that they cannot impact race-free program slices. While the first component is not currently possible to apply to all WGSL programs due to limitations on how some data types can be accessed, we show that existing language constructs are sufficient to implement this component with minimal performance overhead on many existing important WebGPU applications. We test the second component by performing a fuzzing campaign of 81 hours across 21 compilation stacks; our results show violations on only one (likely buggy) machine, thus providing evidence that lower-level GPU frameworks could relatively straightforwardly support this constraint. Finally, our assessments discovered GPU memory isolation vulnerabilities in Apple and AMD GPUs, as well as a security-critical miscompilation of WGSL in a pre-release version of Firefox.
@article{paperbot3006,
title = {SafeRace: Assessing and Addressing WebGPU Memory Safety in the Presence of Data Races},
author = {Reese Levine and Ashley Lee and Neha Abbas and Kyle Little and Tyler Sorensen},
journal = {Proceedings of the ACM on Programming Languages},
volume = {9},
number = {OOPSLA2},
year = {2025},
doi = {10.1145/3763075}
}