Abstract:Reading and writing memory are, besides computation, the most common operations a processor performs. The correctness of these operations is therefore essential for the proper execution of any program. However, as soon as fault attacks are considered, assuming that the hardware performs its memory operations as instructed is not valid anymore. In particular, attackers may induce faults with the goal of reading or writing incorrectly addressed memory, which can have various critical safety and security implications. In this work, we present a solution to this problem and propose a new method for protecting every memory access inside a program against address tampering. The countermeasure comprises two building blocks. First, every pointer inside the program is redundantly encoded using a multi-residue error detection code. The redundancy information is stored in the unused upper bits of the pointer with zero overhead in terms of storage. Second, load and store instructions are extended to link data with the corresponding encoded address from the pointer. Wrong memory accesses subsequently infect the data value allowing the software to detect the error. For evaluation purposes, we implemented our countermeasure into a RISC-V processor, tested it on a FPGA development board, and evaluated the induced overhead. Furthermore, a LLVM-based C compiler has been modified to automatically encode all data pointers, to perform encoded pointer arithmetic, and to emit the extended load/store instructions with linking support. Our evaluations show that the countermeasure induces an average overhead of 10% in terms of code size and 7% regarding runtime, which makes it suitable for practical adoption.

Color My World: Deterministic Tagging for Memory Safety

TikTag: Breaking ARM's Memory Tagging Extension with Speculative Execution

CoMeT: Configurable Tagged Memory Extension

MIPE: a Practical Memory Integrity Protection Method in a Trusted Execution Environment.

Dtee: A Declarative Approach to Secure IoT Applications Using TrustZone

PACSafe: Leveraging ARM Pointer Authentication for Memory Safety in C/C++

TMAC: Taint-based memory protection via access control

PACMem: Enforcing Spatial and Temporal Memory Safety via ARM Pointer Authentication

FRAMER/Miu: Tagged Pointer-based Capability and Fundamental Cost of Memory Safety & Coherence (Position Paper)

MECAT: Memory-Safe Smart Contracts in ARM TrustZone

CryptSan: Leveraging ARM Pointer Authentication for Memory Safety in C/C++

Secure Rewind and Discard on ARM Morello

Pointing in the Right Direction - Securing Memory Accesses in a Faulty World

MetaTableLite - an Efficient Metadata Management Scheme for Tagged-Pointer-Based Spatial Safety.

HMTRace: Hardware-Assisted Memory-Tagging based Dynamic Data Race Detection

MTSan: A Feasible and Practical Memory Sanitizer for Fuzzing COTS Binaries

A Source-Level Instrumentation Framework for the Dynamic Analysis of Memory Safety

Physical Memory Attacks and a Memory Safe Management System for Memory Defense

Saturation Memory Access: Mitigating Memory Spatial Errors without Terminating Programs.

Mon CHÈRI <3 Adapting Capability Hardware Enhanced RISC with Conditional Capabilities

A Parallel Tag Cache for Hardware Managed Tagged Memory in Multicore Processors