CHERI-D: Secure and efficient inline object ID for CHERI temporal memory safety

2026-06-17

AI Summary

This work addresses the lack of native support for temporal memory safety in the CHERI architecture, where existing approaches primarily mitigate use-after-reallocation vulnerabilities and struggle to effectively defend against the more severe use-after-free exploits while incurring substantial performance overhead. To overcome these limitations, the paper proposes a capability pointer extension mechanism that, for the first time, enables inline storage of object ID metadata within allocation slack space in CHERI. The integrity of these embedded IDs is guaranteed by CHERI’s spatial memory safety. Coupled with a deferred reclamation scheme and an efficient revocation strategy, the approach provides strong use-after-free protection while significantly reducing revocation costs. Simulation and hardware evaluations demonstrate that the proposed method achieves substantially higher performance efficiency compared to Cornucopia Reloaded.

Abstract

We propose CHERI-D, an architectural extension to CHERI that supports efficient temporal memory safety. Efficient memory safety is an increasing priority for programming languages, operating systems, and hardware designs, and CHERI is a leading hardware/software system that provides native spatial safety and a foundation for temporal memory safety. Due to CHERI lacking intrinsic architectural support for temporal memory safety, the state-of-the-art CHERI temporal safety solution, Cornucopia Reloaded, is a software-based solution that provides use-after-reallocation (UAR) protections instead of the stronger use-after-free (UAF) mitigation, and suffers performance overhead due to delayed reallocation and revocation. CHERI-D associates object identification (ID) metadata with capability pointers to provide temporal integrity of allocations. CHERI spatial safety allows CHERI-D to store object IDs safely inline with allocation data, potentially within unused fragmentation. Evaluated in simulation and in hardware, CHERI-D significantly reduces the revocation overhead of Cornucopia Reloaded while allowing it to support strict use-after-free mitigation.

Problem

• temporal memory safety
• use-after-free
• CHERI
• memory safety
• capability-based security

Innovation

• CHERI-D
• temporal memory safety
• object ID
• use-after-free mitigation
• capability-based security