Technical Summary: CHERI-D: Secure and Efficient Inline Object ID for CHERI Temporal Memory Safety

Problem Statement

CHERI (Capability Hardware Enhanced RISC Instructions) provides robust spatial memory safety by constraining pointer access ranges, but it lacks intrinsic architectural support for temporal memory safety (detecting use-after-free and use-after-reallocation vulnerabilities). The state-of-the-art software solution, Cornucopia Reloaded, relies on a garbage-collector-like approach that delays memory reallocation. It quarantines freed memory and performs periodic "sweep" operations to revoke dangling capabilities. This approach suffers from significant performance overhead due to:

1. Delayed Reallocation: Preventing immediate reuse of freed memory disrupts allocator optimizations (e.g., thread-local caches in jemalloc), increasing memory footprint and cache pressure.
2. Revocation Costs: Frequent sweeping of the address space to identify and revoke capabilities consumes CPU cycles and increases DRAM traffic.
3. Limited Guarantees: Cornucopia Reloaded primarily mitigates use-after-reallocation (UAR) rather than providing strict use-after-free (UAF) protection, leaving a temporal window where dangling pointers remain exploitable.
4. Scalability Issues: Existing metadata approaches (like ARM MTE) often rely on shadow memory or fixed-granularity tags, incurring memory overhead and failing to scale efficiently for allocation-intensive workloads with frequent small allocations.

Methodology: CHERI-D Architecture

The authors propose CHERI-D, an architectural extension to CHERI that introduces fine-grained tracking of pointer and memory lifetimes (generations) via Object IDs.

Core Mechanism

CHER-D associates an architectural ID with every allocated object.

• Capability Extension: CHERI capabilities are extended with an 8-bit ID field representing the authorized lifetime, along with fields (IDMODE, IDLOC) to locate the corresponding memory ID.
• Inline Metadata: Unlike shadow memory approaches, CHERI-D stores the object ID inline with the allocation data.
  • Inline ID Mode: For allocations fitting within a cache line (e.g., <64 bytes), the ID is placed in the unused internal fragmentation or padding immediately following the data. This ensures spatial locality and allows ID verification to occur simultaneously with data access, incurring zero additional memory latency.
  • In-Page ID Mode: For larger allocations, IDs are stored in a dense table at the top of the physical page containing the allocation. A small hardware buffer caches these IDs to enable early verification before address translation.
• Immediate Reuse: When memory is freed, the allocator increments the memory ID. A stale capability holding an old ID will fail the hardware check upon dereference, triggering a trap. This allows the memory slot to be immediately reused for a new allocation with a new ID, eliminating the need for quarantine buffers for ID-managed allocations.
• Revocation: The kernel revoker can detect dangling capabilities by probing the memory ID (using cgetmemID) rather than relying on a software-managed shadow bitmap. A reserved ID value (e.g., 255) can indicate quarantined memory.

Implementation

The authors implemented CHERI-D prototypes in:

1. Hardware: The CHERI-Toooba superscalar, out-of-order FPGA soft-core.
2. Software: The LLVM/Clang toolchain, the CheriBSD operating system, and the jemalloc system allocator (via the Malloc Revocation Shim wrapper).
3. Simulation: A parameterizable QEMU-based CHERI emulator for architectural scalability studies.

Key Contributions

1. Architectural Extension: A novel CHERI extension that supports strict use-after-free mitigation with immediate memory reuse, overcoming the limitations of software-only revocation.
2. Inline Metadata Design: A method to store object IDs inline within allocation data (utilizing internal fragmentation), avoiding the memory overhead of shadow memory and enabling efficient hardware lookup.
3. Prototype Implementation: Full-system implementations in FPGA and QEMU, integrated with the CheriBSD software stack and jemalloc.
4. Security Validation: Successful detection and mitigation of all 2,422 NIST Juliet test cases for Use-After-Free (CWE-416) and Double Free (CWE-415).
5. Performance Evaluation: Comprehensive benchmarks (SPEC CPU2006 INT, gRPC, SQLite) demonstrating significant reductions in revocation overhead and DRAM traffic compared to Cornucopia Reloaded and PICASSO.

Results

Security

• Strict UAF Mitigation: CHERI-D successfully detects and traps all use-after-free and double-free vulnerabilities in the NIST Juliet suite, providing stronger guarantees than Cornucopia Reloaded's UAR-only protection.
• Deterministic Protection: Unlike probabilistic tagging schemes (e.g., ARM MTE), CHERI-D provides deterministic detection of temporal violations.

Performance

• Revocation Reduction: CHERI-D drastically reduces the frequency of revocation sweeps. For the omnetpp benchmark, revocation sweeps dropped from 2,792 (Cornucopia Reloaded) to 12.
• Overhead:
  • SPEC CPU2006 INT: CHERI-D incurred an average execution time overhead of 1.6%, compared to 13.3% for Cornucopia Reloaded and 5.8% for PICASSO.
  • DRAM Traffic: CHERI-D increased DRAM traffic by only 11.1% on average, whereas Cornucopia Reloaded increased it by 176%.
  • gRPC Latency: At p90 latency, CHERI-D added 8.3% overhead versus 89% for Cornucopia Reloaded.
• Scalability: The design scales effectively to allocation-intensive workloads. Simulations suggest that extending support to larger allocations (up to 256 KiB) could further reduce revocation counts (e.g., reducing SQLite speedtest1 sweeps from 267 to 9).

Significance and Claims

The paper claims that CHERI-D provides a practical and scalable foundation for temporal memory safety in CHERI systems. By moving from a software-based, quarantine-heavy model to an architectural, inline-ID model, CHERI-D achieves:

• Stronger Security: It enables strict use-after-free protection rather than just use-after-reallocation.
• Higher Efficiency: It allows immediate memory reuse, preserving allocator performance characteristics and significantly reducing the system overhead associated with revocation sweeps.
• Scalability: The inline storage mechanism avoids the memory overhead of shadow memory and scales better for workloads with high allocation rates compared to table-based or fixed-granularity tagging schemes.

The authors conclude that CHERI-D principles are likely to underlie future temporal safety standards for CHERI, offering a path to secure, high-performance systems without the prohibitive costs of current software-only solutions.