@inproceedings{filardo2020cornucopia,
author = {Filardo, Nathaniel and Gutstein, Brett F. and Woodruff, Jonathan and Ainsworth, Sam and Paul-Trifu, Lucian and Davis, Brooks and Xia, Hongyan and Napierala, Edward Tomasz and Richardson, Alexander and Baldwin, John and Chisnall, David and Clarke, Jessica and Khilan Gudka,  and Alexandre Joannou,  and Theodore Markettos, A. and Alfredo Mazzinghi,  and Norton, Robert and Roe, Michael and Sewell, Peter and Son, Stacey and Jones, Timothy M. and Moore, Simon and Neumann, Peter G. and Watson, Robert N. M.},
title = {Cornucopia: Temporal Safety for CHERI Heaps},
booktitle = {IEEE Symposium on Security and Privacy},
year = {2020},
month = {May},
abstract = {Use-after-free violations of temporal memory safety continue to plague software systems, underpinning many high impact exploits. The CHERI capability system shows great promise in achieving C and C++ language spatial memory safety, preventing out-of-bounds accesses. Enforcing language-level temporal safety on CHERI requires capability revocation, traditionally achieved either via table lookups (avoided for performance in the CHERI design) or by identifying capabilities in memory to revoke them (similar to a garbage-collector sweep). CHERIvoke, a prior feasibility study, suggested that CHERI’s tagged capabilities could make this latter strategy viable, but modelled only architectural limits and did not consider the full implementation or evaluation of the approach.

Cornucopia is a lightweight capability revocation system for CHERI that implements non-probabilistic C/C++ temporal memory safety for standard heap allocations. It extends the CheriBSD virtual-memory subsystem to track capability flow through memory and provides a concurrent kernel-resident revocation service that is amenable to multi-processor and hardware acceleration. We demonstrate an average overhead of less than 2% and a worst case of 8.9% for concurrent revocation on compatible SPEC CPU2006 benchmarks on a multi-core CHERI CPU on FPGA, and we validate Cornucopia against the Juliet test suite’s corpus of temporally unsafe programs. We test its compatibility with a large corpus of C programs by using a revoking allocator as the system allocator while booting multi-user CheriBSD. Cornucopia is a viable strategy for always-on temporal heap memory safety, suitable for production environments.},
publisher = {IEEE},
url = {http://approjects.co.za/?big=en-us/research/publication/cornucopia-temporal-safety-for-cheri-heaps/},
}