4 ms·
If I understand CHERI correctly it would be UAF + only intended pointer operations on pointers.
by Voultapher 3y ago
If I understand CHERI correctly it would be UAF + only intended pointer operations on pointers.
- sweetjuly 3y agoYeah, you get in-bounds access to the allocation so sub-allocation attacks/cross field is in the play. It's kinda a pain in the ass to turn that into a useful exploit primitive though, and anyways UAF is much easier because (at least with classic allocators) you can corrupt any allocation type. Hardened allocators make exploitable overlaps much harder though and so in practice CHERI's spatial safety might be enough to kill tons of bugs.