Intel and AMD are jointly developing an extended set of instructions called ChkTag (x86 Memory Tagging), which will be standardized for a unified implementation in x86 processors from various manufacturers. ChkTag shares similarities with the MTE (MemTag) extension already provided in ARM processors, and it also helps prevent the exploitation of vulnerabilities related to accessing already freed memory blocks, buffer overflows, or accessing memory before initialization.
ChkTag offers new processor instructions that allow hardware-level tagging of memory regions and organizing pointer usage verification. It is claimed that the application of these instructions by compilers will ensure safe memory operations without compromising application performance. Furthermore, applications utilizing ChkTag will remain compatible with older processors that do not have hardware support for ChkTag, simplifying the implementation of this protection.
The implemented protection method involves creating a tag for each memory block, which acts as a key for accessing that memory (for instance, in the MTE implementation, a 4-bit tag is created for every 16 bytes). The tag is generated by the application for the allocated memory region using special CPU instructions and is then stored in the upper unused bits of the pointer, as well as in a reserved area of linear/virtual memory that is inaccessible to applications. When accessing memory using a tagged pointer, the processor checks the tag associated with the pointer against the tags associated with memory blocks, granting access only if the tags match.
The ChkTag technology was developed through the collaboration of Intel and AMD within the EAG (x86 Ecosystem Advisory Group), formed a year ago to work on ensuring compatibility between x86 platforms, standardizing product interfaces from Intel and AMD, simplifying software development for x86 systems, and identifying developers' needs for expanding the architecture. In addition to Intel and AMD, the group includes Linus Torvalds, creator of the Linux kernel; Tim Sweeney, founder of Epic Games and one of the key developers of the Unreal Engine game engine; as well as representatives from Broadcom, Dell, Google, Hewlett Packard, Lenovo, Meta, Microsoft, Oracle, and Red Hat.
In addition to ChkTag, Intel and AMD have also standardized and unified implementations of the FRED (Flexible Return and Event Delivery) interrupt handling model, the AVX10 vector instruction set, and the ACE (Advanced Matrix Extensions) matrix multiplication extensions.
Source: opennet.ru
