ARM MTE: The End Of Memory Corruption? Not Yet
summary
Hardware MTE uses 4‑bit tags (16 values) so blind brute force succeeds ~1/16 (≈6%) and is noisy; this work combines cache timing and speculative execution to reliably leak tags and bypass MTE. It builds two gadgets (TicTac V1, TicTac V2) that exploit a 10‑cycle gap and store→load forwarding behavior to create a measurable cache difference, implements a JavaScript tag‑leak in V8 to read arbitrary address tags, and demonstrates a Chrome heap‑overflow exploit that no longer crashes under MTE. Vendors acknowledge the issue but treat tags as non‑secret.
AI-written summary · about
chapters (13)
- 0:00Introduction and background
- 2:35What is ARM MTE
- 4:24How MTE works and bypass challenges
- 9:22Tic Tac gadgets and side channels
- 13:16Tic Tac V1 gadget analysis
- 17:58Root cause of Tic Tac behavior
- 22:13Tic Tac V2 and store-to-load forwarding
- 24:26Real-world attack on Google Chrome
- 29:11Heap overflow exploitation demo
- 30:34Vendor responses and mitigations
- 31:59Hardware and software fixes
- 33:47Conclusion and future steps
- 34:49Q&A session
related talks
31mMemory Tagging and how it improves C/C++ memory safety
51mExploiting Hardware Glitches And Side Channels In Perfect Software
33mLife with an Armored Phone and Its Mitigations
24mThe Memory of a Meltdown
33mOver the Edge: Silently Owning Windows 10's Secure Browser
25mThe Memory of a Meltdown
23mMalicious Management Unit: Why Stopping Cache Attacks in Software is Harder Than You Think
47mHow to Hack a Turned-Off Computer, or Running Unsigned Code in Intel Management Engine