CHERI: A Hybrid Capability-System Architecture for Scalable Software Compartmentalization

Abstract

CHERI extends a conventional RISC Instruction-Set Architecture, compiler, and operating system to support fine-grained, capability-based memory protection to mitigate memory-related vulnerabilities in C-language TCBs. We describe how CHERI capabilities can also underpin a hardware-software object-capability model for application compartmentalization that can mitigate broader classes of attack. Prototyped as an extension to the open-source 64-bit BERI RISC FPGA softcore processor, FreeBSD operating system, and LLVM compiler, we demonstrate multiple orders-of-magnitude improvement in scalability, simplified programmability, and resulting tangible security benefits as compared to compartmentalization based on pure Memory-Management Unit (MMU) designs. We evaluate incrementally deployable CHERI-based compartmentalization using several real-world UNIX libraries and applications.

Missing the Point(er): On the Effectiveness of Code Pointer Integrity

“…Secondly, the fat-pointer scheme shows that hardware-based approaches can enforce spatial memory safety at very low overhead [32]. Tagged architectures and capability-based systems can also provide a possible direction for mitigating such attacks [58]. b) Randomization: One possible defense against timing channel attacks, such as the one outlined in this paper, is to continuously rerandomize the safe region and ASLR, before an attacker can disclose enough information about the memory layout to make an attack practical.…”

“…Other efforts such as Cling [4], Memcheck [38], and AddressSanitizer [48] only provide temporal pointer safety to prevent dangling pointer bugs such as use-after-free. A number of hardware-enforced memory safety techniques have also been proposed including the Low-Fat pointer technique [32] and CHERI [58] which minimize the overhead of memory safety checks.…”

Software Design Analysis with Dynamic System Run-Time Architecture Decomposition

“…This identification can be accomplished by viewing existing systems in a component manner [40][17], forming an active research direction of legacy system reverse engineering [43]. In the literature, many modeling techniques are proposed to discover architecture modular structure inside of legacy source code [42][44] [38].…”

“…However, enterprise legacy software systems tend to be large and complex. The analysis of system architecture therefore becomes a difficult task [10][15] [40]. To solve this problem, the current study proposes an approach that decomposes software architecture to reduce the complexity associated with analyzing large scale architecture artifacts.…”

“…As a consequence of this limitation, static analysis does not present sufficient information to study the interactions of source modules [26][27] [34]. Recording dynamic information of a program can provide us with sufficient knowledge about message exchanges and modular interactions during the program execution period [40][41] [19]. However, this technique faces two major issues: (i) the overwhelming volume of tracing data [29][36] and (ii) incomplete coverage of the code [25] [13].…”