Issue
43-byte WAsm module can expose fake CPU architecture
Context
IEEE-754 leaves the sign/payload of a quiet NaN implementation-dependent. A runtime 0/0 commonly produces a negative quiet NaN on x86 (0xFFF8… for f64) and a positive one on ARM (0x7FF8…). JavaScript can inspect the bit through typed arrays, but a spoofing layer can replace those constructors. A tiny WebAssembly function performs the division, reinterprets the f64 as i64, shifts the sign bit, and returns it without relying on page-replaceable typed-array objects.
Minimal instruction sequence:
local.get 0; local.get 0; f64.div; i64.reinterpret_f64;
i64.const 63; i64.shr_u; i32.wrap_i64
The operand must arrive at runtime; V8 can constant-fold literal 0/0 to a canonical NaN and destroy the oracle.
Expected Answer
Additional Context
https://www.clearcotelabs.com/audit/checks/cpu-arch-nan-wasm-vs-js
https://scrapfly.dev/posts/wasm-cpu-architecture-leak/
Note: If you're reporting a bug, use the Bug Report template instead. If you're proposing a feature, use the Feature Request template.
For general discussion or community help, join the Discord.
Issue
43-byte WAsm module can expose fake CPU architecture
Context
IEEE-754 leaves the sign/payload of a quiet NaN implementation-dependent. A runtime 0/0 commonly produces a negative quiet NaN on x86 (0xFFF8… for f64) and a positive one on ARM (0x7FF8…). JavaScript can inspect the bit through typed arrays, but a spoofing layer can replace those constructors. A tiny WebAssembly function performs the division, reinterprets the f64 as i64, shifts the sign bit, and returns it without relying on page-replaceable typed-array objects.
Minimal instruction sequence:
local.get 0; local.get 0; f64.div; i64.reinterpret_f64;
i64.const 63; i64.shr_u; i32.wrap_i64
The operand must arrive at runtime; V8 can constant-fold literal 0/0 to a canonical NaN and destroy the oracle.
Expected Answer
Additional Context
https://www.clearcotelabs.com/audit/checks/cpu-arch-nan-wasm-vs-js
https://scrapfly.dev/posts/wasm-cpu-architecture-leak/
Note: If you're reporting a bug, use the Bug Report template instead. If you're proposing a feature, use the Feature Request template.
For general discussion or community help, join the Discord.