[Paper Review] Memory Tagging: A Memory Efficient Design

Aditi Partap, Dan Boneh|arXiv (Cornell University)|Sep 1, 2022

Security and Verification in Computing4 citations

TL;DR

This paper proposes Memory Tagging: a memory-efficient architectural enhancement to ARM's Memory Tagging Extension (MTE) that uses run-length encoding to compress tag storage, enabling longer (16-bit) tags without increasing memory overhead. The technique improves MTE's security by reducing the probability of tag guessing from 1/16 to 1/65536 while maintaining performance through efficient dynamic tag management.

ABSTRACT

ARM recently introduced a security feature called Memory Tagging Extension or MTE, which is designed to defend against common memory safety vulnerabilities, such as buffer overflow and use after free. In this paper, we examine three aspects of MTE. First, we survey how modern software systems, such as Glibc, Android, Chrome, Linux, and LLVM, use MTE. We identify some common weaknesses and propose improvements. Second, we develop and experiment with an architectural improvement to MTE that improves its memory efficiency. Our design enables longer memory tags, which improves the accuracy of MTE. Finally, we discuss a number of enhancements to MTE to improve its security against certain memory safety attacks.

Motivation & Objective

• To analyze and improve the security and efficiency of MTE in real-world software systems like Glibc, Android, Chrome, and LLVM.
• To address the memory overhead of MTE, which currently uses 4-bit tags and allows a 1/16 chance of tag guessing by attackers.
• To design a dynamic data structure that supports efficient run-length-encoded tag storage for variable-sized allocations.
• To implement and evaluate a modified MTE in QEMU, demonstrating improved security and performance with minimal resource cost.

Proposed method

• Propose a run-length-encoding (RLE) scheme to compress MTE tags, storing only the start address, length, and tag value for contiguous allocations.
• Design a dynamic data structure that supports fast lookup and update of RLE-encoded tags during malloc and free operations.
• Integrate the RLE-based tag system into a QEMU-based emulator of ARMv8.5 to evaluate performance and correctness.
• Use the same 16-bit tag space across all granules, enabling a 1/65536 probability of successful tag guessing, significantly improving security over 4-bit tags.
• Modify existing allocators (Glibc, Scudo, Slub, etc.) to adopt the new tagging strategy, improving their resilience to memory safety attacks.
• Evaluate the performance and memory efficiency of the enhanced MTE design against baseline MTE and existing tools like HWASan and KASAN.

Experimental results

Research questions

• RQ1 How do existing software systems (e.g., Glibc, Android, Chrome) implement MTE tagging, and what are the security weaknesses in their current strategies?
• RQ2 Can MTE’s memory overhead be reduced while increasing tag size to improve security against brute-force attacks?
• RQ3 Is it feasible to use run-length encoding to compress MTE tags without sacrificing performance in dynamic memory allocation?
• RQ4 What performance and memory efficiency improvements can be achieved by using 16-bit tags instead of 4-bit tags in MTE?
• RQ5 How does the proposed RLE-based tag management scheme scale under real-world memory allocation and deallocation workloads?

Key findings

• The proposed RLE-based tag compression reduces the memory required to store tags by a factor of 16 compared to storing individual 16-bit tags, maintaining the same 64GB system footprint.
• The new design enables 16-bit tags, reducing the probability of successful tag guessing from 1/16 to 1/65536, significantly improving security.
• The dynamic RLE data structure supports O(log n) time complexity for tag lookup and update, making it practical for real-time memory allocation.
• The implementation in QEMU shows that the enhanced MTE design maintains low performance overhead, with no measurable regression in malloc/free performance.
• The improved tagging strategy strengthens protection against buffer overflow and use-after-free attacks in Glibc, Android Scudo, and other allocators.
• The approach is compatible with existing software stacks and can be incrementally deployed without source code changes.