arcsinx Posted November 7, 2022 Share Posted November 7, 2022 (edited) Has anyone had the opportunity to play with any CHERI-capable gear yet? https://msrc-blog.microsoft.com/2022/01/20/an_armful_of_cheris/ By my understanding it will turn many forms of memory safety bugs into a safe crash even for existing buggy C code. Quote CheriABI provides complete object-granularity (and, potentially, field- or array-element-granularity) spatial memory safety. Composed with other existing mitigations, our prior analysis showed that this would have deterministically prevented around 43% of vulnerabilities submitted to MSRC in 2019. Compartmentalization could further limit the damage that an attacker could do with some of these vulnerabilities. Our ongoing work, in collaboration with the University of Cambridge and SRI, on CHERI heap temporal safety would increase this to almost 70%. Edited November 7, 2022 by arcsinx linkify link, if it will let me Link to comment Share on other sites More sharing options...
aeline Posted November 9, 2022 Share Posted November 9, 2022 I have not but I certainly find the idea cool. I've done a decent bit reasoning about memory safety on language side. Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now