Smarter Shopping, Better Living!  Aliexpress.com

Memory tagging is coming to kill all of your favorite Linux kernel exploits!

Memory Tagging Extension (MTE) is an ARM v8.5 feature that enables hardware-assisted validation of the correctness of memory accesses. In a nutshell, MTE allows assigning tags to memory allocations, as well as to pointers that refer to those allocations. When a pointer is accessed, the CPU performs a validity check that ensures that the memory tag matches the pointer tag.

In this talk, I explain how MTE is used to assert the validity of kernel memory accesses. I describe the newly added Hardware Tag-Based KASAN mode, its weaknesses, and planned improvements.

Slides: https://docs.google.com/presentation/d/1IpICtHR1T3oHka858cx1dSNRu2XcT79-RCRPgzCuiRk/edit?usp=sharing

Twitter: https://twitter.com/andreyknvl
Website: https://xairy.io/

00:00 Intro
03:16 Memory tagging
04:49 Arm Memory Tagging Extension
10:28 In-kernel MTE or Hardware Tag-Based KASAN
13:19 Preventing memory corruptions with Hardware Tag-Based KASAN
17:14 Implementation details of Hardware Tag-Based KASAN
20:48 Weaknesses of Hardware Tag-Based KASAN
25:29 Outro