Memory Tagging and how it improves C/C++ memory safety (1802.09517v1)

Abstract: Memory safety in C and C++ remains largely unresolved. A technique usually called "memory tagging" may dramatically improve the situation if implemented in hardware with reasonable overhead. This paper describes two existing implementations of memory tagging: one is the full hardware implementation in SPARC; the other is a partially hardware-assisted compiler-based tool for AArch64. We describe the basic idea, evaluate the two implementations, and explain how they improve memory safety. This paper is intended to initiate a wider discussion of memory tagging and to motivate the CPU and OS vendors to add support for it in the near future.

• The paper demonstrates that hardware-assisted memory tagging can significantly reduce memory safety issues in C/C++ environments.
• It compares SPARC ADI and AArch64 HWASAN, outlining their differences in tag granularity, CPU overhead, and detection precision.
• The findings advocate integrating MT for always-on testing in production to minimize critical memory errors and deter exploit strategies.

Memory Tagging and its Role in Enhancing C/C++ Memory Safety

The paper authored by Kostya Serebryany et al. investigates the efficacy of memory tagging (MT) in addressing memory safety concerns in C/C++ environments, emphasizing hardware-supported MT systems. Despite various existing mechanisms such as AddressSanitizer (ASAN) and other memory safety tools, memory safety in these languages remains a critical concern. This discussion pivots on the potential of MT strategies to tackle these persistent challenges and evaluates two distinct implementations: SPARC ADI and AArch64 HWASAN.

Memory Safety Challenges in C/C++

C/C++ is historically plagued by memory safety issues due to its flexibility and performance-oriented design. Standard tools and techniques such as AddressSanitizer, Valgrind, fuzzing, and ASLR provide mitigation strategies, yet memory safety bugs remain prolific in production environments. The three decades-long grappling with memory safety reflects a need for innovative solutions. This paper proposes that integrating hardware-assisted memory tagging could be a decisive step towards substantially reducing memory safety bugs in applications.

Memory Tagging Methodology

Memory Tagging (MT) involves associating memory regions with tags to verify pointer access against these tags. The SPARC ADI implementation utilizes a granularity of TG=64 and tag size TS=4, whereas the AArch64 HWASAN employs TG=16 and TS=8. Tag mismatch during operations triggers exceptions, thereby probabilistically detecting memory access violations with a high accuracy, depending on the TS value.

Evaluating Existing Implementations

SPARC ADI

SPARC ADI provides a full hardware-based MT solution, operational on SPARC M7/M8 CPUs. Its notable features include options for handling store instructions and memory tagging without significant overhead in imprecise mode. The CPU overhead is minimal compared to ASAN, except in malloc-intensive applications.

AArch64 HWASAN

HWASAN is a semi-hardware assisted solution primarily relying on compiler instrumentation for bug detection, thus incurring higher CPU overhead but maintaining better detection reliability than ASAN. Notably, it leverages the top-byte-ignore hardware feature available in AArch64 to store address tags.

Overhead and Usage Modes

The paper explores the overhead costs associated with MT, outlining sources such as RAM consumption due to over-alignment and additional instructions inserted during compile time. Memory tagging systems aim to function with minimal intrusion on performance, making them viable for various usage models including always-on bug detection, production sampling, and security hardening.

Implications and Future Directions

The paper posits that memory tagging could transform memory safety protocols for both user-space applications and kernels, especially when combined with per-process sampling. By enabling always-on testing in production environments, MT can highlight bugs that sandboxed testing cannot, thus providing a more robust safety net against exploitation. Despite its probabilistic nature, MT complicates the execution of complex attack strategies, serving as a deterrent by raising the difficulty and reducing the predictability of successful exploits.

Conclusion

Memory tagging, as presented, is a promising addition to the current suite of memory safety tools. While memory tagging will not resolve all safety issues outright, its integration into hardware systems has the potential to significantly reduce the prevalence of memory safety violations in C/C++ environments and enhance overall application robustness. The paper concludes with a call to action for hardware and software vendors to incorporate and support memory tagging technologies, thereby standardizing their use across industry applications.

The discourse initiated by this research encourages a collaborative effort towards refining and implementing MT, aspiring to create a safer, more secure programming ecosystem. The discussion prompted by this paper is crucial in advancing toward that strategic shift.