Cornucopia: Temporal safety for CHERI heaps
| Autor: | Peter Sewell, Khilan Gudka, David Chisnall, Alexander Richardson, Robert N. M. Watson, Alexandre Joannou, Stacey Son, John Baldwin, Edward Napierala, Michael Roe, Robert M. Norton, Nathaniel Wesley Filardo, Alfredo Mazzinghi, Simon W. Moore, Jessica Clarke, Jonathan Woodruff, Sam Ainsworth, Brooks Davis, Brett F. Gutstein, Peter G. Neumann, Lucian Paul-Trifu, A. Theodore Markettos, Hongyan Xia, Timothy M. Jones |
|---|---|
| Rok vydání: | 2020 |
| Předmět: |
010302 applied physics
Revocation Computer science Spec# 02 engineering and technology computer.software_genre 3301 Architecture 01 natural sciences 020202 computer hardware & architecture Allocator Memory management 46 Information and Computing Sciences 0103 physical sciences 0202 electrical engineering electronic engineering information engineering Operating system Test suite Hardware acceleration 33 Built Environment and Design Memory safety computer Booting computer.programming_language Heap (data structure) |
| Zdroj: | Proceedings of the 41st IEEE Symposium on Security and Privacy (SP) 2020 IEEE Symposium on Security and Privacy (SP) IEEE Symposium on Security and Privacy |
| DOI: | 10.17863/cam.51119 |
| Popis: | Use-after-free violations of temporal memory safety continue to plague software systems, underpinning many high-impact exploits. The CHERI capability system shows great promise in achieving C and C++ language spatial memory safety, preventing out-of-bounds accesses. Enforcing language-level temporal safety on CHERI requires capability revocation, traditionally achieved either via table lookups (avoided for performance in the CHERI design) or by identifying capabilities in memory to revoke them (similar to a garbage-collector sweep). CHERIvoke, a prior feasibility study, suggested that CHERI’s tagged capabilities could make this latter strategy viable, but modeled only architectural limits and did not consider the full implementation or evaluation of the approach. Cornucopia is a lightweight capability revocation system for CHERI that implements non-probabilistic C/C++ temporal memory safety for standard heap allocations. It extends the CheriBSD virtual-memory subsystem to track capability flow through memory and provides a concurrent kernel-resident revocation service that is amenable to multi-processor and hardware acceleration. We demonstrate an average overhead of less than 2% and a worst-case of 8.9% for concurrent revocation on compatible SPEC CPU2006 benchmarks on a multi-core CHERI CPU on FPGA, and we validate Cornucopia against the Juliet test suite’s corpus of temporally unsafe programs. We test its compatibility with a large corpus of C programs by using a revoking allocator as the system allocator while booting multi-user CheriBSD. Cornucopia is a viable strategy for always-on temporal heap memory safety, suitable for production environments. |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|