Memory safety notes
Hardware-assisted protection: different properties
A property-based comparison of memory tagging, control-flow protection, and capabilities.
Background & research notes · AGIACC
Technical note. These mechanisms address different parts of the problem; they are not interchangeable security scores.
| Approach | Intended property | Integration question |
|---|---|---|
| Memory tagging | Detect selected invalid accesses through tag checks | Which allocations are tagged, and how are faults reported? |
| Control-flow protection | Restrict selected control transfers | Which transfers and software components are covered? |
| Capability-based protection | Constrain memory authority using bounds and permissions | How do the compiler, allocator, and runtime establish boundaries? |
Linux documents MTE’s configuration and fault modes. Intel describes CET’s shadow stack and indirect branch tracking. Cambridge explains how CHERI policies are expressed in software and enforced by hardware.
An architectural check can provide a strong guarantee about its specified operation while the wider system still contains policy errors, unprotected components, or unsafe allowed behavior. Temporal safety, compartmentalization, and availability depend on the particular platform and runtime design.
Performance comparisons need named workloads, hardware, software versions, and baselines. We do not publish a general percentage that covers all implementations.
Next: MTE in practice.