Re: CHERI vs. address sanitizer

[Bruno Haible]

Jessica Clarke wrote:
> > The answer is in [3], page 4, table III: CHERI does not detect 
> > use-after-free
> > and stack-use-after-return bugs ("temporal memory safety").
> ...
> clarifies how things were at the time of writing a bit:
> 
>   e) Double-free: This is an example of a temporal mem- ory safety
>      vulnerability that the Cornucopia [33] extension of PureCap could
>      detect, but the stable version does not.
> 
> For many years heap temporal safety was in a separate branch

In other words: heap temporal safety was work in progress.

This coincides with what I read in [1]:
   Userspace temporal safety — Experimental

> but our
> upcoming 23.11 release (i.e. later this month, all being well) will have
> heap temporal safety available (it's already in our development
> snapshots) and enabled by default for all CHERI processes, and at some
> point when I get the chance after that I will upgrade cfarm240 to that
> release.

Nice! I had been under the impression that temporal pointer safety was
not included in the CHERI architecture. Glad to hear that it is.

> ASan has
> the advantage of being instrumentation that you can inject for your
> native architecture, but CHERI can catch more things

And I'm reading [2][3] that CHERI instrumentation is also coming to
Linux/x86_64 and Linux/arm64. This would also be cool :-)

Bruno

[1] https://www.morello-project.org/cheri-feature-matrix/
[2] 
https://www.morello-project.org/resources/cheriseed-port-effortlessly-to-cheri/
[3] 
https://git.morello-project.org/morello/llvm-project/-/blob/cheriseed/clang/docs/CHERIseed.rst