A Security Analysis of CheriBSD and Morello Linux

2026-01-27

AI Summary

While the CHERI architecture mitigates memory corruption attacks, its isolation mechanisms in CheriBSD and Morello Linux remain vulnerable to circumvention. This work presents the first systematic evaluation of the practical security of isolation in CHERI-based operating systems, uncovering four novel classes of isolation bypass vulnerabilities. Leveraging the CHERI capability model and operating system–level security analysis, we propose deployable mitigation strategies and validate their effectiveness through concrete attack demonstrations. Our findings not only expose critical security weaknesses in current CHERI implementations but also offer actionable guidance for hardening future high-assurance systems.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Hardware-aware ML
• Cognitive Modeling & Cognitive Systems: Other Foundations of Cognitive Modeling & Systems

Application Category

• Security and Privacy: Large-scale security measurements
• Responsible Web: Measurement, analysis, and circumvention of Web censorship
• Systems and Infrastructure for Web, Mobile and WoT: Web performance, measurement, and characterization

Abstract

Memory corruption attacks have been prevalent in software for a long time. Some mitigation strategies against these attacks do exist, but they are not as far-reaching or as efficient as the CHERI architecture. CHERI uses capabilities to restrict pointers to certain regions of memory and with certain access restrictions. These capabilities are also used to implement"compartmentalisation": dividing a binary into smaller components with limited privilege, while adhering to the principle of least privilege. However, while this architecture successfully mitigates memory corruption attacks, the compartmentalisation mechanisms in place are less effective in containing malicious code to a separate compartment. This paper details four ways to bypass compartmentalisation, with a focus on Linux and BSD operating systems ported to this architecture. We find that although compartmentalisation is implemented in these two operating systems, simple bugs and attacks can still allow malicious code to bypass it. We conclude with mitigation measures to prevent these attacks, a proof-of-concept demonstrating their use, and recommendations for further securing Linux and BSD against unknown attacks.

Problem

• CHERI
• compartmentalisation
• memory corruption
• capability-based security
• Morello

Innovation

• CHERI
• compartmentalisation
• memory corruption
• capability-based security
• Morello