jrtc27

6 ms·

1.
by jrtc27 1y ago
> Unfortunately, the time between free and revocation introduces a short-but-not-zero window for UAF bugs/attacks. This time gap is even explicitly acknowledged in the Reloaded paper! Yes, revocation is batched and asynchronous. Thi
2.
by jrtc27 1y ago
You may wish to read what the current pure-capability CHERI Linux user ABI specifies for mremap(), because we (primarily Arm, in conjunction with us) have thought about this, and the conclusion is not "the existence of mremap() makes C
3.
by jrtc27 1y ago
> Does that study include enabling intra object overflow protection, or not? > > When I say that this optional feature would force you to change a lot more code I’m comparing CHERI without intra object overflow protection to CHERI
4.
by jrtc27 1y ago
Yeah you need a compiler, linker and OS. That's true of any security technology. CHERI may be more significant in that regard because it's a bigger rethink than just stuffing some extra metadata into the existing types, but it&#x2
5.
by jrtc27 1y ago
No. The capability itself lives in normal memory intermingling with data just like any other pointer. There is no "capabilities memory", it is just memory. In MTE, you have the N-bit (typically 4) per-granule (typically 16 byte) &
6.
by jrtc27 1y ago
Where studies suggest "a lot" is sub-0.1%. For example, https://www.capabilitieslimited.co.uk/_files/ugd/f4d681_e0f2... was a study into porting 6 million lines of C and C++ to run a KDE+X11 desktop stac
7.
by jrtc27 1y ago
Can you elaborate on what you perceive as broken?
8.
by jrtc27 1y ago
To reiterate what I've said elsewhere, CHERI does not need a whole parallel memory architecture, there is just one that gets a slight extension over a non-CHERI/MTE system to include tags. But that is the same story as MTE, which
9.
by jrtc27 1y ago
Cambridge and Arm have made a joint statement that nothing that is essential to the deployment of CHERI ("capability essential IP") is being patented by them: https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-95
10.
by jrtc27 1y ago
> has a parallel capability stack There is one stack, the normal program stack that's normal main memory. > capability pointers If you use pure-capability CHERI C/C++ then there is only one type of pointer to manage; they ju
11.
by jrtc27 1y ago
That's not true. Capabilities are in main memory as much as any other data. The tags are in separate memory (whether a wider SRAM, DRAM ECC bits, or a separate table off on the side in a fraction of memory that's managed by the
12.
by jrtc27 1y ago
We actually have ideas for how to combine the two; see section C.5 of https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-987.pdf
13.
by jrtc27 2y ago
64-bit size_t is the same on Darwin as GNU/Linux (unsigned long), but uint64_t is not (Darwin defines it as unsigned long long, not unsigned long). Perhaps this is what you remember?
14.
by jrtc27 2y ago
Stop-the-world is only brief, to scan the register file of each thread and any other capabilities held in the kernel (asynchronous I/O, signal handlers, etc). Once done the entire memory sweep can be done concurrent with execution. As
15.
by jrtc27 3y ago
CHERI can provide heap temporal safety to protect against use-after-free (really, use-after-reallocation; use-after-free is harmless until the point at which the memory is being used for something else, and deferring lets you batch revocati
16.
by jrtc27 3y ago
The hardware must, and does, ensure that the metadata (both addressable - bounds, permissions, etc - and non-addressable - the tag) is kept atomic with the address portion of the capability, as otherwise you would be able to forge capabilit
17.
by jrtc27 3y ago
The SoC IP used in ASUS's Tinker V deliberately violates the virtual memory spec in a way that affects userspace, rendering certain virtual addresses unusable. This region overlaps with the default base address of position-dependent ex
18.
by jrtc27 3y ago
> Doing this at the actual hardware level (as you're implying with registers) doesn't really work - there's too much variation in how languages work, how languages work changes over time, and it's also extremely expen
19.
by jrtc27 4y ago
They don't ship with spacers?
20.
by jrtc27 5y ago
Oh I know. Hardly inspires confidence; all of those examples are clear bugs declared features because of poor programming practices.
21.
by jrtc27 5y ago
> The if directive is tricky to use, especially in location{} blocks. It often doesn’t do what you expect and can even cause segfaults. That's not user error. That's lazy programming and a bug. If your code segfaults because of
22.
by jrtc27 5y ago
CHERI is not an actor system. It is a capability system aimed at memory protection. It can be used, like any other architecture, as a basis upon which to build an actor-based framework/system, but it is no more of an actor system than,
23.
by jrtc27 5y ago
Your research on actor-based programming models has nothing to do with C/C++ spatial and temporal memory safety.
24.
by jrtc27 5y ago
Yes it's non-zero, though https://www.capabilitieslimited.co.uk/pdfs/20210917-capltd-c... is a recent exploration of what it takes to port X11 and KDE to CHERI. Of the around 6 million lines of C and C++ code invo
25.
by jrtc27 5y ago
Yes, though "software" is rather broad; where exactly the bounds setting happens is important as if you get it wrong it allows malicious software to not set bounds and be able to access memory outside of its allocations. Pushing i
26.
by jrtc27 5y ago
You should indeed run sanitisers during testing and catch most of the issues; we encourage this! What CHERI provides is twofold: 1. Memory safety issues not found in testing do not lurk as exploitable vulnerabilities; testing is never perfe
27.
by jrtc27 5y ago
Then great, they push for the adoption of the technology and the world's computers become more secure. Arm's a big corporation and they're obviously pretty involved, and both Microsoft and Google are invested in the project.
28.
by jrtc27 5y ago
They're relevant because they're technologies relating to memory safety and provide some level of additional protection. However, they rely on secrets and are in general only probabilistic, so they don't deterministically mit
29.
by jrtc27 5y ago
I've bootstrapped Rust for RISC-V on FreeBSD, it's not that bad, the issues I faced were solely porting issues, not bootstrapping issues. I've certainly not had cross-compiling issues like Drew. The awful part about porting R
30.
by jrtc27 5y ago
The only thing that gets weird is the primary thread's stack limit, since we need to construct that capability up-front with the right bounds. This means we have a somewhat arbitrary upper limit (which you could make tunable, though I

More ›