Conversation

Memory tagging is coming to kill all of your favorite Linux kernel exploits. I'll be premiering my "Mitigating Linux kernel memory corruptions with Arm Memory Tagging" LSS talk on YouTube in 24 hours. Please join in! I'll be in chat to answer questions. youtube.com/watch?v=UwMt0e

141

546

Replying to

Fantastic talk and work! Excited to see future work on this. If using async mode, is it plausible that the attack payload executed prior to detection could target the very exception vector intended to handle tag mismatches?

Replying to

Thank you! Yes, that's what I would do. Assuming there's enough time to execute the payload before the detection fires.

Replying to

Thanks, interesting! While I know you mentioned that productized implementations aren't available yet, are there any SoC-FPGA based prototypes available for experimentation?

Replying to

Not that I know of. But there are Arm Fast Models that support MTE. They are slow, but supposedly replicate how an actual CPU would behave.

Replying to

and

And there's QEMU support for MTE, as I mention in the talk.

9:17 PM · Oct 2, 2021Twitter Web App