PICASSO: 使用彩色能力将CHERI释放后使用保护扩展到数百万次分配
PICASSO: Scaling CHERI Use-After-Free Protection to Millions of Allocations using Colored Capabilities
AI总结：
针对CHERI架构缺乏堆时间安全性的问题，提出彩色能力，通过硬件管理的来源有效性表实现批量撤销悬空指针，无需隔离释放内存，在CHERI-RISC-V上实现PICASSO，有效缓解释放后使用和双重释放漏洞，性能开销小。
摘要：
虽然CHERI指令集架构扩展通过能力实现了强大的空间内存安全性，但CHERI缺乏内置的时间安全性，特别是针对堆分配。先前尝试为CHERI增加时间安全性的工作在可扩展性、内存开销和安全性保证方面存在不足，因为它们需要定期扫描系统内存以单独撤销陈旧能力。我们通过引入彩色能力来解决这些限制，该能力为CHERI的能力模型增加了受控的间接形式。这使得能够通过硬件管理的来源有效性表追踪能力到其各自的分配，从而无需隔离释放内存即可批量撤销悬空指针。彩色能力显著减少了能力撤销扫描的频率，同时提高了安全性。我们在PICASSO中实现了彩色能力，这是CHERI-RISC-V架构在推测乱序FPGA软核（CHERI-Toooba）上的扩展。我们还将彩色能力支持集成到CheriBSD操作系统和启用CHERI的Clang/LLVM工具链中。我们的评估表明，在NIST Juliet测试用例和真实世界CVE中，对所有基于堆的时间内存安全漏洞，有效缓解了释放后使用和双重释放错误，SPEC CPU基准测试的性能开销很小（几何平均5%），与先前工作相比，在长时间运行的SQLite、PostgreSQL和gRPC工作负载中延迟更低，性能更一致。
英文摘要：
While the CHERI instruction-set architecture extensions for capabilities enable strong spatial memory safety, CHERI lacks built-in temporal safety, particularly for heap allocations. Prior attempts to augment CHERI with temporal safety fall short in terms of scalability, memory overhead, and incomplete security guarantees due to periodical sweeps of the system's memory to individually revoke stale capabilities. We address these limitations by introducing colored capabilities that add a controlled form of indirection to CHERI's capability model. This enables provenance tracking of capabilities to their respective allocations via a hardware-managed provenance-validity table, allowing bulk retraction of dangling pointers without needing to quarantine freed memory. Colored capabilities significantly reduce the frequency of capability revocation sweeps while improving security. We realize colored capabilities in PICASSO, an extension of the CHERI-RISC-V architecture on a speculative out-of-order FPGA softcore (CHERI-Toooba). We also integrate colored-capability support into the CheriBSD OS and CHERI-enabled Clang/LLVM toolchain. Our evaluation shows effective mitigation of use-after-free and double-free bugs across all heap-based temporal memory-safety vulnerabilities in NIST Juliet test cases, , real-world CVEs, only a small performance overhead on SPEC CPU benchmarks (5% g.m.), less latency, and more consistent performance in long-running SQLite, PostgreSQL, and gRPC workloads compared to prior work.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
