Memory Tagging Extensions
Arm's MTE Hardware Protection
Overview
Much like with Pointer Authentication, Arm consistently comes out with hardware-enabled protections that provide greater security. MTE, as it is called, is a hardware-based defence against memory safety vulnerabilities.
There are two common mistakes in memory management that commonly cause vulnerabilities:
Spatial Safety
OOB access, Buffer Overflow
Program accesses memory outside of the allocated region
MTE aims to mitigate both of these vulnerabilities using a "lock" and "key" system.
Operation: Tagging
Within the lock and key system, there are two types of tagging:
Address Tagging (the key) - adds a four-bit "tag" to the top of every pointer used in the program; this only works in 64-bit applications since it uses "top-byte-ignore", an Arm 64-bit feature
Memory Tagging (the lock) - also consists of four bits, linked to every 16-byte aligned region in the applications memory space (these regions are referred to as tag granules)
The idea is that, through address tagging, a pointer can only access a region of memory if the memory tag matches the address tag. Let's take some slides from this talk:
The pointer p is "tagged" with the green tag, but is attempting to access memory that is tagged purple. The processor notes that the tag of the pointer is different to that of the purple tag, and throws an error.
On initial allocation via malloc, 2N bytes of space is tagged green, and the pointer is tagged green. Then, when the green pointer is freed, the green memory is retagged to red. If the green pointer is then used again, the processor will notice a difference in tag and throw an error.
How is MTE used?
There are three modes of MTE: Synchronous, Asynchronous and Asymmetric.
Synchronous mode is optimized for correctness of bug detection and has the highest overhead; on a tag mismatch, the process terminates with SIGSEGV immediately
Asynchronous is optimized for performance; on a tag mismatch, the process continues execution until the nearest kernel entry, and then terminates with SIGSEGV
Asymmetric is an improvement on Asynchronous in pretty much every way, doing synchronous checking on reads and asynchronous on writes
Android suggests using SYNC mode for testing to catch bugs, and use ASYMM in production (or ASYNC if ASYMM does not exist in the processor) due to the lowr overhead.
While MTE is incredibly powerful, it is sometimes too powerful, and as a result it is not always enabled by default. Many apps with buggy invalid accesses work perfectly fine silently, but will cause a full crash if MTE is enabled. As a result MTE is not forced upon user-installed apps on either Android or iOS. Due to performance concerns, MTE is not enabled by default for the Android kernel either.
Enhanced MTE
This is a set of modifications made to MTE thanks to Apple, through collaboration with Arm. I can find little information about it except here under the heading FEAT_MTE4, Enhanced Memory Tagging Extension. It is very much linked to Apple's new Memory Integrity Enforcement.
Resources
Last updated
Was this helpful?