Technical Summary: A Security Analysis of CheriBSD and Morello Linux

Problem Statement

Memory corruption attacks remain a prevalent threat in software systems. While the CHERI architecture offers a robust hardware-enforced solution through capabilities—128-bit pointers that define memory regions and access permissions—it aims to mitigate these attacks and enforce "compartmentalisation." This architectural feature divides binaries into smaller components with limited privileges, adhering to the principle of least privilege. However, while CHERI effectively mitigates direct memory corruption (e.g., buffer overflows), the mechanisms for containing malicious code within separate compartments are less effective.

This paper investigates the security of compartmentalisation in real-world operating systems ported to the CHERI architecture, specifically Morello Linux and CheriBSD. The central problem is that despite hardware protections, simple bugs and information leaks in system software (dynamic linkers, allocators, and stack management) allow malicious code to bypass compartmentalisation, gaining access to secrets or code in more privileged compartments.

Methodology

The authors adopt a threat model where an attacker possesses arbitrary code execution within an unprivileged library of a process. The attacker aims to gain code execution or access to secrets in a more privileged library or the main binary. This scenario simulates supply chain compromises where a malicious library is integrated into an application. The attack scope is limited to user-space memory safety; system calls (like execve) and pseudo-file system exploits are out of scope.

The research methodology involves:

1. Recursive Capability Scanning: A novel technique developed by the authors. Starting from a single valid capability (e.g., a stack pointer or a heap pointer), the attacker recursively scans memory regions accessible via that capability. Whenever a new valid capability is found, it is added to a list, and the scan recurses. This allows the attacker to map the "transitive closure" of reachable memory, identifying capabilities that point outside the intended compartment.
2. Exploitation of System Components: The authors target specific components of the Morello Linux and CheriBSD implementations:
   • Dynamic Linkers: Analyzing functions like dlopen() to see if they inadvertently leak capabilities.
   • Stack Management: Checking if capabilities from previous stack frames are cleared.
   • Heap Allocators: Investigating whether freed memory is zeroed or if capabilities are left behind in heap chunks.
3. Proof-of-Concept (PoC): The authors implement exploits on ARM Morello prototype boards to demonstrate the leakage of private keys (e.g., OpenSSL RSA keys) from a main binary to a malicious library.

Key Contributions

The paper details four specific vectors for bypassing compartmentalisation:

1. Stack Walking:

   • Mechanism: Malicious code accesses the stack pointer and recursively scans previous stack frames.
   • Vulnerability: Capabilities (including sealing keys) are often left in stack memory after function returns.
   • Impact: In Morello Linux, this allows the retrieval of sealing capabilities, enabling the unsealing of protected data. In CheriBSD, the c18n mitigation (isolated stacks) largely prevents this, though some capabilities remain accessible.

2. Dlopen Infoleak:

   • Mechanism: The dlopen() function returns an internal structure (e.g., Obj_Entry) containing capabilities to loaded libraries.
   • Vulnerability: Both Morello Linux and CheriBSD return pointers to these internal structures without sealing them. By casting the return value, an attacker can access the mapbase capability, which points to the .text section of the main binary and all loaded libraries.
   • Impact: This provides a direct path to read and write memory across compartment boundaries, effectively bypassing isolation.

3. Heap Scavenging:

   • Mechanism: The attacker repeatedly allocates memory to find chunks that were previously used by other compartments and not zeroed.
   • Vulnerability: If the heap allocator does not zero memory upon freeing, valid capabilities may persist in the freed chunks.
   • Impact: The attacker can recover these capabilities and use the recursive scanner to expand their reach. This was effective in both Morello Linux and CheriBSD (against certain allocators).

4. Heap Storing:

   • Mechanism: The attacker saves a pointer to a freed heap chunk and attempts to access it later.
   • Vulnerability: If the memory is not invalidated or revoked, the attacker can read data written to that chunk by the main binary.
   • Impact: Effective in Morello Linux. In CheriBSD, the heap revocation mitigation (quarantining freed chunks and invalidating capabilities after an epoch) successfully blocks this attack.

Results

• Morello Linux: All four attack vectors were successful. The system lacks built-in mitigations for compartmentalisation beyond the raw capabilities, making it highly vulnerable to stack walking and dlopen infoleaks.
• CheriBSD: The system is more robust due to specific mitigations:
  • c18n (Stack Isolation): Effectively neutralized the stack walking attack by providing isolated stacks for each compartment.
  • Heap Revocation: Effectively neutralized the heap storing attack.
  • Remaining Vulnerabilities: The dlopen infoleak and heap scavenging attacks remained successful. The dlopen vulnerability is particularly critical as it allows an attacker to traverse the entire loaded binary and library space.
• Proof-of-Concept: The authors successfully demonstrated a full compromise where a malicious library, initially isolated, used the dlopen infoleak to locate a capability pointing to the main binary's heap. Through recursive scanning, they located and extracted a private RSA key generated by the OpenSSL library, which was intended to be inaccessible.

Significance and Claims

The paper claims that while the CHERI architecture provides strong primitives for memory safety, the implementation of compartmentalisation in current operating systems (Morello Linux and CheriBSD) is insufficient to contain malicious libraries.

The authors emphasize that the vulnerabilities are not flaws in the CHERI architecture itself, but rather in the operating systems, compilers, and dynamic linkers that utilize these primitives. Specifically:

• Information Leaks are Critical: In CHERI, a leaked pointer is not just an address; it reveals validity, permissions, and memory ranges. This makes information leaks (like the dlopen return value) significantly more dangerous than in traditional architectures.
• Recursive Scanning: The paper introduces the recursive capability scan as a fundamental attack primitive that exploits the metadata inherent in CHERI capabilities to map the entire reachable address space from a single foothold.
• Need for Hardening: The authors conclude that achieving secure compartmentalisation requires more than just hardware support; it necessitates rigorous mitigation strategies such as sealing handles in dlopen, zeroing heap memory, and enforcing strict stack isolation (like c18n).

The paper serves as a warning that without these specific software-level mitigations, the promise of CHERI-based compartmentalisation can be easily broken by relatively simple exploits.