CHERI-D: Secure and efficient inline object ID for CHERI temporal memory safety

The gist: CHERI-D proposes an architectural extension to CHERI that supports efficient temporal memory safety by associating object identification (ID) metadata with capability pointers to provide temporal integrity of allocations.

Background

CHERI provides spatial safety by constraining the memory access range of pointers within bounds that cannot be forged or increased, but it lacks intrinsic architectural support for temporal memory safety, which is why solutions like Cornucopia Reloaded rely on software-based garbage-collector-like approaches to mitigate use-after-reallocation (UAR) [1]. Cornucopia Reloaded employs a garbage-collector-like (GC) approach that delays reallocation until a sweep of the address space has revoked dangling heap capabilities, which results in performance overhead due to delayed reallocation and revocation [2]. This strategy primarily mitigates use after reallocation rather than providing a stronger guarantee of use after free (UAF) protection, thus still permitting vulnerabilities to exploit undefined allocator behavior [2].

CHERI-D Architecture

CHERI-D introduces architectural support for finegrained tracking of pointer/memory lifetime (i.e. generation) to provide temporal guarantees [1]. It assigns an architecturally protected lifetime identifier to each allocated object, allowing a single memory location to be issued under multiple allocation lifetimes, with the previous lifetime identifier deprecated after every reallocation [1]. The extension includes:

- An 8-bit capability ID field to represent the lifetime that a capability is authorized to access, as shown in Figure 1 [5].

- A 1-bit capability ID mode (IDMODE) field to differentiate capabilities using the inline ID storage scheme (5.4) from the in-page scheme (5.5).

- A 6-bit capability ID location (IDLOC) field to encode the memory ID location according to the scheme selected by IDMODE.

- The new ID update instruction, csetcapID, used to set the ID in a capability.

- The csetmemID instruction used to update the memory ID associated with allocation.

- Two new instructions, cgetcapID and cgetmemID, used to read the ID from the capability and memory, respectively.

The protection model enforces monotonicity properties via guarded manipulation of capabilities [5]. The allocator must maintain an independent capability that authorizes access to the object ID memory location in order to update the object ID on free or allocation [5].

Memory Identification Schemes

CHERI-D decouples ID management from fixed memory granularities, associating a single ID with each allocation [5]. It supports two granularities: 64-byte lines and 4-kilobyte pages [5].

1. Inline IDs: For allocations that fit within a cache line, the IDLOC is simply encoded relative to the cache line base in which the allocation resides, placing the ID above the allocation top [5]. This mode is preferred to improve spatial locality between the inlined ID and the data, eliminating the need to buffer metadata using additional SRAM caches and tag controller support [5].

2. In-page IDs: For allocations that span multiple cache lines, this approach places the ID within the same page as the allocation [5]. This enables efficient, early ID lookup in hardware by placing 64 object IDs at the top of each page, allowing for precise exceptions on store operations without notable performance overhead [5].

Immediate Reuse and Revocation

CHERI-D allows allocator slots occupied by freed objects to be immediately reused with a new ID; accesses from stale pointers will safely trap due to ID mismatch [5]. The process of incrementing the ID associated with the slot when memory is freed can continue until the ID space is exhausted, allowing an allocation to be safely reallocated up to 254 times while preserving temporal safety guarantees [5]. CHERI-D can architecturally represent quarantined allocations by reserving an ID value; the revoker can identify dangling capabilities without relying on the shadow bitmap [8]. The kernel revoker is modified to detect dangling capabilities by probing the capability ID in memory using cgetcapID, and if the capability ID is zero, it falls back to the shadow bitmap for revocation [8].

Evaluation Results

Evaluations demonstrate that CHERI-D substantially reduces revocation overhead while preserving stronger temporal memory safety guarantees [2]. On SPEC CPU2006 INT benchmarks run on FPGA, Omnetpp experiences a runtime overhead of 104.6% under Cornucopia Reloaded, but CHERI-D reduces the number of revocation sweeps from 2792 to just 12 [11]. For gRPC QPS latency, CHERI-D incurs an overhead of 8.3% at the p90 latency percentile, compared to 89% for Cornucopia Reloaded [10]. Furthermore, extending support to larger allocation sizes up to 64 KiB substantially reduces both the maximum resident set size (MRSS) and the total number of revocations across SPEC workloads [12].

Conclusion

CHERI-D provides a foundation for practical and scalable CHERI temporal safety, offering strong, efficient temporal safety guarantees at the architectural level [15]. The results suggest that CHERI-D can substantially reduce both execution-time and memory-system overhead by enabling immediate memory reuse and significantly reducing the frequency of revocation [10]. Future work will explore architectural techniques to enable direct ID lookup across multiple pages while limiting additional address translations, and extend the benefits of CHERI-D to larger allocations [14].

Acknowledgments

We thank our colleagues on the CHERI team from the University of Cambridge for building the CHERI research platforms, and especially Jessica Clark for her assistance in getting our experiments up and running [15]. We are also grateful to Merve Gulmez and Thomas Nyman at Ericsson Security Research for their help in reproducing the evaluations they had previously conducted [15].

References

[1] R. N. M. Watson, P. G. Neumann, J. Woodruff, M. Roe, H. Almatary, J. Anderson, J. Baldwin, G. Barnes, D. Chisnall, J. Clarke, B Davis: “Capability Hardware Enhanced RISC Instructions: CHERI Instruction-Set Architecture (Version 9),” Computer Laboratory: “Capability Hardware Enhanced RISC Instructions: CHERI Instruction-Set Architecture (Version 9),” Computer Laboratory, University of Cambridge, Tech. Rep., 2023 [1].

[2] Nicolas Joly, Saif ElSherei, Saar Amar: “Security Analysis of CHERI ISA,” https://www.microsoft.com/en-us/msrc/blog/2020/10/securityanalysis-of-cheri-isa, Oct. 2020 [2].

[3] N. W. Filardo, B F Gutstein, J Woodruff: “Cornucopia Reloaded: Load Barriers for CHERI Heap Temporal Safety,” in Proceedings of the 29th ACM International Conference on Architectural Support for Programming Languages and Operating Systems, Volume 2. La Jolla CA USA: ACM, Apr. 2024 [3].

[5] Y. Wang, J Woodruff, A Mazzinghi: “CHERI-D: Secure and efficient inline object ID for CHERI temporal memory safety,” arXiv:2606.19055v1 17 Jun 2026 [5].

[8] S Amar, T Chen, D Chisnall: “CHERIoT: Rethinking security for low-cost embedded systems,” 2023 [8].

[9] Matthew Gretton-Dann: “Arm Community,” https://developer.arm.com/community/arm-communityblogs/b/architectures-and-processors-blog/posts/arm-a-profilearchitecture-2018-developments-armv85a, 2018 [9].

[10] “Application Data Integrity feature introduced by SPARC M7,” https://lwn.net/Articles/712531/, 2026 [10].

[14] ——, “CTSRD-CHERI/cheribsd,” 2026 [14].

[15] J Evans: “A Scalable Concurrent malloc(3) Implementation for FreeBSD,” 2026 [15].

[16] T Boland and P E Black: “Juliet 1.1 C/C++ and Java Test Suite,” Computer, vol. 45, no. 10, pp. 88–90, Oct. 2012 [16].

[27] M Gulmez, R Sturm: “PICASSO: Scaling CHERI Use-AfterFree Protection to Millions of Allocations using Colored Capabilities,” May 2026 [27].

[30] P D Rugg: “Efficient spatial and temporal safety for microcontrollers and application-class processors,” Computer Laboratory, University of Cambridge, Tech. Rep., 2023 [30].

[31] “Dynamic Memory Allocation In SQLite,” https://sqlite.org/malloc.html, 2026 [31].

--- Page 1 ---

The gist: CHERI-D proposes an architectural extension to CHERI that supports efficient temporal memory safety by associating object identification (ID) metadata with capability pointers to provide temporal integrity of allocations.

1. Bold Header: Architectural Support for Strict Use-After-Free Mitigation

CHERI-D supports strict use-after-free mitigation by associating an architecturally protected lifetime identifier to each allocated object, which allows for immediate and safe memory reuse while preserving strong temporal safety guarantees.

2. Bold Header: Efficient Memory Reuse and Reduced Revocation Overhead

The system can achieve a reduction in revocation frequency by allowing freed memory to be promptly returned to the allocator, as CHERI-D substantially reduces revocation overhead while preserving stronger temporal memory safety guarantees, contrasting with solutions that rely on delayed reallocation and revocation.

3. Bold Header: Scalable Metadata Management for Large Workloads

The system scales efficiently for allocation-intensive workloads by allowing 256 lifetimes and using an ID scheme where a single memory location may be issued under multiple allocation lifetimes, with the previous lifetime identifier deprecated after every reallocation.

4. Bold Header: Elimination of Shadow Bitmap Overhead

CHERI-D eliminates the need for a software bitmap by allowing the revoker to detect dangling capabilities without relying on the shadow bitmap, modifying the trade-off for both allocator and revoker.

5. Bold Header: Improved Performance in Memory Access Patterns

The system utilizes inline ID storage to improve spatial locality, as it allows the ID lookup that must accompany data access is truly free when the ID is on the same cache line with the data being accessed.

We propose CHERI-D, an architectural extension to CHERI that supports efficient temporal memory safety. Efficient memory safety is an increasing priority for programming languages, operating systems, and hardware designs, and CHERI is a leading hardware/software system that provides native spatial safety and a foundation for temporal memory safety. Due to CHERI lacking intrinsic architectural support for temporal memory safety, the state-of-the-art CHERI temporal safety solution, Cornucopia Reloaded, is a software-based solution that provides use-after-reallocation (UAR) protections instead of the stronger use-after-free (UAF) mitigation, and suffers performance overhead due to delayed reallocation and revocation. CHERI-D associates object identification (ID) metadata with capability pointers to provide temporal integrity of allocations. CHERI spatial safety allows CHERI-D to store object IDs safely inline with allocation data, potentially within unused fragmentation. Evaluated in simulation and in hardware, CHERI-D significantly reduces the revocation overhead of Cornucopia Reloaded while allowing it to support strict use-after-free mitigation.