CHERI-D: Secure and efficient inline object ID for CHERI temporal memory safety

summary

Video file (mp4)

The gist

The gist: CHERI-D proposes an architectural extension to CHERI that supports efficient temporal memory safety by associating object identification (ID) metadata with capability pointers to provide

In short

CHERI-D extends CHERI to support efficient temporal memory safety by linking object identification (ID) metadata directly to capability pointers. This architectural change allows for fine-grained tracking of memory lifetimes, enabling immediate reuse of freed slots and significantly reducing the performance overhead associated with revocation compared to previous software solutions.

Key concepts

CHERI
CHERI is a hardware/software system that provides spatial safety. It ensures pointer safety by constraining the memory access range of pointers, preventing unauthorized memory reads or writes outside allocated bounds. However, it lacks built-in support for temporal safety.
Temporal Memory Safety
This refers to ensuring that memory accesses are valid not just spatially (within bounds), but also temporally (at the correct time). Temporal safety guarantees that a pointer remains valid for its intended duration, preventing use-after-reallocation or use-after-free errors.
Capability ID Metadata
CHERI-D associates an 8-bit capability ID with each allocated object. This ID tracks the object's specific allocation lifetime. By storing this metadata in the capability pointer itself, the system can verify if a pointer is still valid for its current allocation period, ensuring temporal integrity.
Inline vs. In-page IDs
CHERI-D supports two memory identification schemes: Inline IDs place the ID near the data within a cache line for better locality. In-page IDs store the ID within the same page as the allocation, allowing for fast hardware lookups and precise exception handling.

Terminology used across episodes

This episode discusses

The paper

CHERI-D: Secure and efficient inline object ID for CHERI temporal memory safety · Read on arXiv

University of Cambridge

We propose CHERI-D, an architectural extension to CHERI that supports efficient temporal memory safety. Efficient memory safety is an increasing priority for programming languages, operating systems, and hardware designs, and CHERI is a leading hardware/software system that provides native spatial safety and a foundation for temporal memory safety. Due to CHERI lacking intrinsic architectural support for temporal memory safety, the state-of-the-art CHERI temporal safety solution, Cornucopia Reloaded, is a software-based solution that provides use-after-reallocation (UAR) protections instead of the stronger use-after-free (UAF) mitigation, and suffers performance overhead due to delayed reallocation and revocation. CHERI-D associates object identification (ID) metadata with capability pointers to provide temporal integrity of allocations. CHERI spatial safety allows CHERI-D to store object IDs safely inline with allocation data, potentially within unused fragmentation. Evaluated in simulation and in hardware, CHERI-D significantly reduces the revocation overhead of Cornucopia Reloaded while allowing it to support strict use-after-free mitigation.

Transcript

Introduction to the show: ident: Security Radio. Generated commentary on the latest security and cryptography papers.

Nadia: We're looking at the paper: "CHERI-D: Secure and efficient inline object ID for CHERI temporal memory safety".

Elias: The gist: CHERI-D proposes an architectural extension to CHERI that supports efficient temporal memory safety by associating object identification (ID) metadata with capability pointers to provide temporal integrity of allocations.

Nadia: First, who's behind it and why it matters.

Paper summary: Nadia: So looking at "CHERI-D: Secure and efficient inline object ID for CHERI temporal memory safety," what we’re seeing is a solid architectural extension to CHERI that addresses the lack of intrinsic temporal memory safety support. Elias It focuses on associating object identification metadata with capability pointers to give us temporal integrity for allocations.

Priya: The main thing they’re claiming is that this approach allows reclaimed memory to be promptly returned to the allocator without exposing newly allocated objects to dangling pointers <ref:2606.19055#pg2>.

Nadia: That immediate reuse capability, combined with the ability to support up to two hundred fifty-four generations of reallocations, really makes a difference in how we manage memory at runtime <ref:2606.19055#pg2>.

Elias: And they also showed that this design substantially reduces revocation overhead compared to older software solutions, with the number of sweeps dropping significantly when tested on SPEC CPU2006 INT workloads eleven <ref:2606.19055#pg2>.

Priya: So for someone just listening, this paper suggests that we can build memory safety features directly into the hardware architecture without needing those heavy software garbage collectors to manage lifetimes fifteen <ref:2606.19055#pg3>.

Nadia: The authors of "CHERI-D: Secure and efficient inline object ID for CHERI temporal memory safety" are working on making scalable support for larger IDs possible, which was a challenge in previous tagging schemes <ref:2606.19055#pg2>.

Elias: They're showing that this method can substantially reduce both execution-time and memory system overhead by enabling immediate memory reuse and significantly reducing the frequency of revocation sweeps ten <ref:2606.19055#pg2>.

Priya: It’s about providing strong, efficient temporal safety guarantees at the architectural level, which is what this paper sets up for future work fifteen <ref:2606.19055#pg3>.

Conclusion: Nadia: So we're wrapping up this look at CHERI-D, which is about adding architectural support for temporal safety to CHERI using inline object IDs, and the authors are working on making this work practical and scalable.

Elias: Yeah, I’m looking at that title again—"CHERI-D: Secure and efficient inline object ID for CHERI temporal memory safety"—and it sounds like they’re tackling a real gap in the existing CHERI design.

Priya: It seems like the whole point is taking something that relies on software tricks, like Cornucopia Reloaded, and putting a way to handle this directly into the hardware capabilities.

Nadia: Exactly. So what does this mean for us right now? It means we might actually be able to get stronger use-after-free protection without that heavy performance hit from delayed garbage collection sweeps.

Elias: From a cryptographic standpoint, it’s about making sure the lifetime of an object is tied directly to its capability using that eight-bit ID field and the new instructions they introduced like `csetcapID`.

Priya: And the memory identification schemes they proposed, both inline and in-page IDs—that’s where I want to see some detail. How does that choice between those two affect what kind of application can use it effectively?

Nadia: Well, the paper shows it lets you choose based on how your data is laid out; inline IDs are better for cache line locality, but in-page IDs could give you faster lookups if things get bigger.

Elias: They also show that this way of doing things actually reduces the number of times the system has to sweep through memory just to clean up dangling pointers, which is a big win for performance metrics.

Priya: I'm interested in those evaluation results, because they show how much overhead it actually adds. If we can keep the runtime overhead low while getting better safety guarantees, that’s where it gets interesting for real systems.

Nadia: Right. So this paper sets up a foundation for having temporal safety built into the core architecture, not bolted on as a slow software layer.

Elias: It’s moving from something that requires complex software management to something handled by the hardware itself, which is where we want to go with these kinds of security extensions.

More episodes

← Home