CHERIvoke: Characterising Pointer Revocation Using CHERI Capabilities for Temporal Memory Safety

Hongyan Xia, Jonathan Woodruff, Sam Ainsworth, Nathaniel Filardo, Michael Roe, Alexander Richardson, Peter Rugg, Peter G. Neumann, Simon W. Moore, Robert N. M. Watson, Timothy M Jones

Research output: Chapter in Book/Report/Conference proceedingConference contribution


A lack of temporal safety in low-level languages has led to an epidemic of use-after-free exploits. These have surpassed in number and severity even the infamous buffer-overflow exploits violating spatial safety. Capability addressing can directly enforce spatial safety for the C language by enforcing bounds on pointers and by rendering pointers unforgeable. Nevertheless, an efficient solution for strong temporal memory safety remains elusive.

CHERI is an architectural extension to provide hardware capability addressing that is seeing significant commercial and open-source interest. We show that CHERI capabilities can be used as a foundation to enable low-cost heap temporal safety by facilitating out-of-date pointer revocation, as capabilities enable precise and efficient identification and invalidation of pointers, even when using unsafe languages such as C. We develop CHERIvoke, a technique for deterministic and fast sweeping revocation to enforce temporal safety on CHERI systems. CHERIvoke quarantines freed data before periodically using a small shadow map to revoke all dangling pointers in a single sweep of memory, and provides a tunable trade-off between performance and heap growth. We evaluate the performance of such a system using high-performance x86 processors, and further analytically examine its primary overheads. When configured with a heap-size overhead of 25%, we find that CHERIvoke achieves an average execution-time overhead of under 5%, far below the overheads associated with traditional garbage collection, revocation, or page-table systems.
Original languageEnglish
Title of host publicationProceedings of the 52nd Annual IEEE/ACM International Symposium on Microarchitecture
Place of PublicationNew York, NY, USA
PublisherACM Association for Computing Machinery
Number of pages13
ISBN (Print)9781450369381
Publication statusPublished - 12 Oct 2019
Event52nd IEEE/ACM International Symposium on Microarchitecture - Columbus, United States
Duration: 12 Oct 201916 Oct 2019

Publication series

NameMICRO ’52
PublisherAssociation for Computing Machinery
ISSN (Electronic)1072-4451


Conference52nd IEEE/ACM International Symposium on Microarchitecture
Abbreviated titleMICRO 2019
CountryUnited States
Internet address


  • use-after-free
  • temporal safety
  • security
  • architecture


Dive into the research topics of 'CHERIvoke: Characterising Pointer Revocation Using CHERI Capabilities for Temporal Memory Safety'. Together they form a unique fingerprint.

Cite this