Mon CH'ERI: Mitigating Uninitialized Memory Access with Conditional Capabilities

2024-07-11

AI Summary

Uninitialized variables account for approximately 10% of memory-safety vulnerabilities in C/C++, yet existing software-based mitigations remain ineffective. This paper proposes the first hardware-assisted, fine-grained protection mechanism leveraging conditional capabilities—specifically extending the Write-before-Read (WbR) policy on the CHERI-RISC-V architecture. The hardware dynamically grants read access to a memory location only if it has been explicitly written to prior to reading, thereby enforcing initialization safety at the microarchitectural level. This approach fills a critical gap in CHERI’s memory-safety guarantees, which previously lacked support for uninitialized-memory detection. We implement and validate the mechanism using a customized compiler, QEMU full-system simulation, and FPGA-based soft-core execution. Our evaluation demonstrates precise, low-overhead detection: runtime overhead is merely ~3.5%, comparable to baseline CHERI capability checks—achieving both practical deployability and high efficiency.

Technology Category

• Machine Learning: Hardware-aware ML
• Natural Language Processing: Safety and Robustness
• Reasoning under Uncertainty: Causality

Application Category

• Security and Privacy: Large-scale security measurements
• Responsible Web: Data and user privacy-enhancing technologies for the Web
• Search and Retrieval-Augmented AI: Web evaluation methodologies and metrics

Abstract

Up to 10% of memory-safety vulnerabilities in languages like C and C++ stem from uninitialized variables. This work addresses the prevalence and lack of adequate software mitigations for uninitialized memory issues, proposing architectural protections in hardware. Capability-based addressing, such as the University of Cambridge's CHERI, mitigates many memory defects, including spatial and temporal safety violations at an architectural level. CHERI, however, does not handle undefined behavior from uninitialized variables. We extend the CHERI capability model to include"conditional capabilities", enabling memory-access policies based on prior operations. This allows enforcement of policies that satisfy memory-safety objectives such as"no reads to memory without at least one prior write"(Write-before-Read). We present our architecture extension, compiler support, and detailed evaluation of our approach on the QEMU full-system simulator and a modified FPGA-based CHERI-RISCV softcore. Our evaluation shows conditional capabilities are practical, with high detection accuracy while adding a small (~3.5%) overhead which is comparable to the cost of baseline CHERI capabilities.

Problem

• Addresses uninitialized memory vulnerabilities in C/C++
• Extends CHERI capability model with conditional capabilities
• Enforces Write-before-Read policy for memory safety

Innovation

• Extends CHERI with conditional capabilities
• Enforces Write-before-Read memory policies
• Adds minimal overhead (~3.5%)