BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

4.3 Memory Safety Violations

NIST platform security: roots of trust, firmware and secure enclaves IR 8320
All changes in this version
first version loaded 4 Software Runtime Protection Mechanisms part of 4

Title

Memory Safety Violations

Control

Approximately 70 percent of the vulnerabilities addressed through security updates each year are memory safety issues [12] . They are especially common in programs written in languages such as C and C++ that expose pointers. These code bugs can be exploited by attackers to reveal data, including keys and other secrets. There are both temporal and spatial memory safety violations. Some common examples of both types are as follows:

• use-after-free : a program continues to use allocated memory after releasing it ( temporal )

• use-out-of-scope : a program uses memory from another program scope not within its current scope ( temporal )

• use-before-initialization : a program accesses memory that has been allocated but not yet initialized ( temporal )

• bounds violations, buffer overflow : a program accesses memory beyond the bounds of an allocated buffer/data structure ( spatial ) Hardware-based technologies have been introduced or are being developed in the industry to address memory safety violations. Both require companion software support.

The first, memory tagging (also known as coloring, versioning, or tainting) is discussed in [13] and [14] . It is a probabilistic lock-and-key approach to detecting memory violation bugs. With a tag size of 4, the probability of detecting a bug is 94 percent; with a tag size of 8, the probability is 99.6 percent. Memory tagging is expected to be generally applicable to 64-bit software written in C and C++. Use in mixed-language environments, e.g., C/C++ code and interacting with just- in-time (JIT) compiled or interpreted languages, is also expected to benefit. Applicability to software in other languages will vary. Since memory tagging imposes no changes to standard C/C++ application binary interfaces (ABIs), incremental deployment is possible.

The second is capability-based hardware systems, which enable software to efficiently implement fine-grained memory protection and scalable software compartmentalization by providing strong, non-probabilistic, efficient mechanisms to support the principles of least privilege and intentional use in the execution of software at multiple levels of abstraction, preventing and mitigating memory safety vulnerabilities.

Hardware capability technology combines references to memory locations—pointers—with limits on how the references can be used. These limits relate to both the address ranges and the functionality that the references can be used to access. This combined information is called a capability . It is constructed so that it cannot be forged by software. Replacing pointers with capabilities in a program vastly improves memory safety.

The benefit of hardware capability technology goes beyond memory safety. This is because capabilities can be used as a building block for more fine-grained compartmentalization of software. This could result in inherently more robust software that is resistant to attack. A powerful feature of compartmentalization is that even if one compartment is compromised by an attacker, the attacker cannot break out of the compartment to access any other information or to take overall control of the computing system.

In addition to changes to hardware, capability-based security requires re-architecting how code is designed. Code must be written and compiled in a different way to take advantage of the novel hardware features and to achieve a more secure result.

Several defenses and preventative measures have been developed within industry to accommodate memory safety violations, including the following:

• Arm Privileged Access Never (PAN)

• Arm User (EL0) Execute Never (UXN) and Privileged (EL1/EL2) Execute Never (PXN)

• Arm Memory Tagging Extension (MTE)

• Arm Hardware Enforced Capability-Based Architecture (Morello and CHERI)