5 posts
CHERI's hybrid ABI lets you port C code to capability hardware incrementally.
You have a C codebase that is too large to rewrite in Rust and too critical to leave exposed to buffer overflows. CHERI capability hardware promises to catch…
Memory safety at the hardware level has been possible since the 1970s.
Seventy percent of CVEs are memory safety bugs. Buffer overflows, use-after-free, double frees. The kind of vulnerabilities that let an attacker pivot from a…
Containers are overkill for isolating a single C library.
A single null pointer dereference inside a C library can bring down your entire application. If that library parses user input, decompresses images, or handles…
ARM Memory Tagging Extension and GWP-ASan make production memory safety detection possible on modern mobile devices.
Your phone can detect memory corruption in production. Not with the full instrumentation you run in CI, and not on every allocation. But the hardware in your…
CHERI is a hardware extension that turns every pointer into a bounded capability.
Buffer overflows have been on the CWE Top 25 for twenty years. We have stack canaries, ASLR, DEP, control-flow integrity, and memory-safe languages, yet they…