News for hackers. Stuff that matters.
Re:The Arm64 memory tagging extension in Linux by swills on Monday October 19, 2020 @10:04AM (#24826437)
Re:The Arm64 memory tagging extension in Linux by saagarjha on Monday October 19, 2020 @10:06AM (#24826460)
It’s similar, but CHERI provides much stronger guarantees. (The ARM implementation will use 128-bit pointers, with the top half being used to store much more granular keys.)
Re:The Arm64 memory tagging extension in Linux by cmarinas on Monday October 19, 2020 @01:33PM (#24828682)
CHERI provides spatial protection and is very strong at this but does not handle temporal protection well (use-after-free for example). Once a pointer is given to another code entity/compartment it is hard to revoke the permission since that's tied to the (capability) pointer itself, not the memory it points to. There are workarounds but not that nice.

MTE, OTOH, was specifically designed for detecting temporal bugs. For example, a freed object has the allocation tag (stored in memory) changed by the heap allocator so that the original pointer (with the original tag) can no longer access it. Of course, the trade-off is the 4 bits per 16-byte granule that need to be stored somewhere and the probabilistic nature (1 in 16 chance of hitting it).

But I think CHERI and MTE would complement each other nicely.