Mon CH\'ERI: Mitigating Uninitialized Memory Access with Conditional Capabilities

TL;DR

This paper extends the CHERI hardware capability model with conditional capabilities to prevent uninitialized memory access, providing a hardware-software solution that enforces memory-safety policies with minimal performance overhead.

Contribution

We introduce conditional capabilities in CHERI, enabling enforcement of memory-safety policies for uninitialized variables through hardware and compiler support.

Findings

Conditional capabilities effectively detect uninitialized memory access.

Overhead of the approach is approximately 3.5%, comparable to baseline CHERI.

High detection accuracy demonstrated in simulation and FPGA implementations.

Abstract

Up to 10% of memory-safety vulnerabilities in languages like C and C++ stem from uninitialized variables. This work addresses the prevalence and lack of adequate software mitigations for uninitialized memory issues, proposing architectural protections in hardware. Capability-based addressing, such as the University of Cambridge's CHERI, mitigates many memory defects, including spatial and temporal safety violations at an architectural level. CHERI, however, does not handle undefined behavior from uninitialized variables. We extend the CHERI capability model to include "conditional capabilities", enabling memory-access policies based on prior operations. This allows enforcement of policies that satisfy memory-safety objectives such as "no reads to memory without at least one prior write" (Write-before-Read). We present our architecture extension, compiler support, and detailed evaluation of our approach on the QEMU full-system simulator and a modified FPGA-based CHERI-RISCV softcore. Our evaluation shows conditional capabilities are practical, with high detection accuracy while adding a small (~3.5%) overhead which is comparable to the cost of baseline CHERI capabilities.