CHERIvoke: Characterising pointer revocation using CHERI capabilities for temporal memory safety
View / Open Files
Authors
Xia, H
Woodruff, J
Filardo, Nathaniel
Roe, M
Rugg, P
Neumann, PG
Watson, Robert
Publication Date
2019-10-12Journal Title
Proceedings of the Annual International Symposium on Microarchitecture, MICRO
ISSN
1072-4451
ISBN
9781450369381
Pages
545-557
Type
Conference Object
This Version
AM
Metadata
Show full item recordCitation
Xia, H., Woodruff, J., Ainsworth, S., Filardo, N., Roe, M., Richardson, A., Rugg, P., et al. (2019). CHERIvoke: Characterising pointer revocation using CHERI capabilities for temporal memory safety. Proceedings of the Annual International Symposium on Microarchitecture, MICRO, 545-557. https://doi.org/10.1145/3352460.3358288
Abstract
A lack of temporal safety in low-level languages has led to an epidemic of use-after-free exploits. These have surpassed in number and severity even the infamous buffer-overflow exploits violating spatial safety. Capability addressing can directly enforce spatial safety for the C language by enforcing bounds on pointers and by rendering pointers unforgeable. Nevertheless, an efficient solution for strong temporal memory safety remains elusive.
CHERI is an architectural extension to provide hardware capability addressing that is seeing significant commercial and open- source interest. We show that CHERI capabilities can be used as a foundation to enable low-cost heap temporal safety by facilitating out-of-date pointer revocation, as capabilities enable precise and efficient identification and invalidation of pointers, even when using unsafe languages such as C. We develop CHERIvoke, a technique for deterministic and fast sweeping revocation to enforce temporal safety on CHERI systems. CHERIvoke quarantines freed data before periodically using a small shadow map to revoke all dangling pointers in a single sweep of memory, and provides a tunable trade-off between performance and heap growth. We evaluate the performance of such a system using high-performance x86 processors, and further analytically examine its primary overheads. When configured with a heap-size overhead of 25%, we find that CHERIvoke achieves an average execution-time overhead of under 5%, far below the overheads associated with traditional garbage collection, revocation, or page-table systems.
Sponsorship
EP/K026399/1, EP/P020011/1, EP/K008528/1
Funder references
EPSRC (EP/K026399/1)
EPSRC (EP/P020011/1)
EPSRC (EP/R012458/1)
Government Communications Headquarters (GCHQ) (Unknown)
EPSRC (EP/K008528/1)
Identifiers
External DOI: https://doi.org/10.1145/3352460.3358288
This record's URL: https://www.repository.cam.ac.uk/handle/1810/296287
Rights
All rights reserved