Porting to Morello: An In-depth Study on Compiler Behaviors, CERT Guideline Violations, and Security Implications

Sami Ullah; Awais Rashid

doi:10.1109/EuroSP60621.2024.00028

Porting to Morello: An In-depth Study on Compiler Behaviors, CERT Guideline Violations, and Security Implications

Sami Ullah, Awais Rashid

School of Computer Science

Research output: Chapter in Book/Report/Conference proceeding › Conference Contribution (Conference Proceeding)

88 Downloads (Pure)

Abstract

As the need for secure systems grows, the exploration of secure hardware like Morello, based on the Capability Hardware Enhanced RISC Instructions (CHERI) architecture, becomes crucial. As Morello navigates towards market induction, establishing systematic approaches for transitioning software to its pure capability mode emerges as a crucial research endeavor. This paper investigates two main areas: a comparison with CERT guidelines and an exploitation analysis on the Morello platform. The comparison aims to identify potential developer-induced vulnerabilities and compiler limitations, elucidating how the Morello-llvm compiler behaves when there are CERT rule violations. Our exploitation analysis explores the limitations of the Morello-llvm compiler toolchain and the developer errors that could bypass Morello’s advanced security features. The findings highlight that despite advancements in toolchains, developer-induced vulnerabilities remain a significant issue, emphasizing the importance of adhering to established programming standards like CERT guidelines.

Original language	English
Title of host publication	2024 IEEE 9th European Symposium on Security and Privacy (EuroS&P)
Publisher	IEEE Computer Society
Pages	381-397
Number of pages	17
ISBN (Electronic)	979-8-3503-5425-6
ISBN (Print)	979-8-3503-5426-3
DOIs	https://doi.org/10.1109/EuroSP60621.2024.00028
Publication status	Published - 22 Aug 2024
Event	9th IEEE European Symposium on Security and Privacy - University of Vienna, Vienna, Austria Duration: 8 Jul 2024 → 12 Jul 2024 https://eurosp2024.ieee-security.org/index.html

Publication series

Name	IEEE European Symposium on Security and Privacy
Publisher	IEEE
ISSN (Print)	2995-1348
ISSN (Electronic)	2995-1356

Conference

Conference	9th IEEE European Symposium on Security and Privacy
Abbreviated title	EuroS&P 2024
Country/Territory	Austria
City	Vienna
Period	8/07/24 → 12/07/24
Internet address	https://eurosp2024.ieee-security.org/index.html

Bibliographical note

Publisher Copyright:
© 2024 IEEE.

Keywords

Morello/CHERI exploitation
Porting efforts
CERT guidelines

Access to Document

10.1109/EuroSP60621.2024.00028

Full-text PDF (accepted manuscript)
This is the accepted author manuscript (AAM) of the article which has been made Open Access under the University of Bristol's Scholarly Works Policy. The final published version (Version of Record) can be found on the publisher's website. The copyright of any third-party content, such as images, remains with the copyright holder.
Accepted author manuscript, 236 KBLicence: CC BY

Handle.net

Persistent link

Cite this

@inproceedings{dd83f9ba73074e8f9780a3a5a1e1d61d,

title = "Porting to Morello: An In-depth Study on Compiler Behaviors, CERT Guideline Violations, and Security Implications",

abstract = "As the need for secure systems grows, the exploration of secure hardware like Morello, based on the Capability Hardware Enhanced RISC Instructions (CHERI) architecture, becomes crucial. As Morello navigates towards market induction, establishing systematic approaches for transitioning software to its pure capability mode emerges as a crucial research endeavor. This paper investigates two main areas: a comparison with CERT guidelines and an exploitation analysis on the Morello platform. The comparison aims to identify potential developer-induced vulnerabilities and compiler limitations, elucidating how the Morello-llvm compiler behaves when there are CERT rule violations. Our exploitation analysis explores the limitations of the Morello-llvm compiler toolchain and the developer errors that could bypass Morello{\textquoteright}s advanced security features. The findings highlight that despite advancements in toolchains, developer-induced vulnerabilities remain a significant issue, emphasizing the importance of adhering to established programming standards like CERT guidelines.",

keywords = "Morello/CHERI exploitation, Porting efforts, CERT guidelines",

author = "Sami Ullah and Awais Rashid",

note = "Publisher Copyright: {\textcopyright} 2024 IEEE.; 9th IEEE European Symposium on Security and Privacy, EuroS&P 2024 ; Conference date: 08-07-2024 Through 12-07-2024",

year = "2024",

month = aug,

day = "22",

doi = "10.1109/EuroSP60621.2024.00028",

language = "English",

isbn = "979-8-3503-5426-3",

series = "IEEE European Symposium on Security and Privacy",

publisher = "IEEE Computer Society",

pages = "381--397",

booktitle = "2024 IEEE 9th European Symposium on Security and Privacy (EuroS&P)",

address = "United States",

url = "https://eurosp2024.ieee-security.org/index.html",

}

Ullah, S & Rashid, A 2024, Porting to Morello: An In-depth Study on Compiler Behaviors, CERT Guideline Violations, and Security Implications. in 2024 IEEE 9th European Symposium on Security and Privacy (EuroS&P). IEEE European Symposium on Security and Privacy, IEEE Computer Society, pp. 381-397, 9th IEEE European Symposium on Security and Privacy, Vienna, Austria, 8/07/24. https://doi.org/10.1109/EuroSP60621.2024.00028

Porting to Morello: An In-depth Study on Compiler Behaviors, CERT Guideline Violations, and Security Implications. / Ullah, Sami ; Rashid, Awais.
2024 IEEE 9th European Symposium on Security and Privacy (EuroS&P). IEEE Computer Society, 2024. p. 381-397 (IEEE European Symposium on Security and Privacy).

Research output: Chapter in Book/Report/Conference proceeding › Conference Contribution (Conference Proceeding)

TY - GEN

T1 - Porting to Morello

T2 - 9th IEEE European Symposium on Security and Privacy

AU - Ullah, Sami

AU - Rashid, Awais

PY - 2024/8/22

Y1 - 2024/8/22

N2 - As the need for secure systems grows, the exploration of secure hardware like Morello, based on the Capability Hardware Enhanced RISC Instructions (CHERI) architecture, becomes crucial. As Morello navigates towards market induction, establishing systematic approaches for transitioning software to its pure capability mode emerges as a crucial research endeavor. This paper investigates two main areas: a comparison with CERT guidelines and an exploitation analysis on the Morello platform. The comparison aims to identify potential developer-induced vulnerabilities and compiler limitations, elucidating how the Morello-llvm compiler behaves when there are CERT rule violations. Our exploitation analysis explores the limitations of the Morello-llvm compiler toolchain and the developer errors that could bypass Morello’s advanced security features. The findings highlight that despite advancements in toolchains, developer-induced vulnerabilities remain a significant issue, emphasizing the importance of adhering to established programming standards like CERT guidelines.

AB - As the need for secure systems grows, the exploration of secure hardware like Morello, based on the Capability Hardware Enhanced RISC Instructions (CHERI) architecture, becomes crucial. As Morello navigates towards market induction, establishing systematic approaches for transitioning software to its pure capability mode emerges as a crucial research endeavor. This paper investigates two main areas: a comparison with CERT guidelines and an exploitation analysis on the Morello platform. The comparison aims to identify potential developer-induced vulnerabilities and compiler limitations, elucidating how the Morello-llvm compiler behaves when there are CERT rule violations. Our exploitation analysis explores the limitations of the Morello-llvm compiler toolchain and the developer errors that could bypass Morello’s advanced security features. The findings highlight that despite advancements in toolchains, developer-induced vulnerabilities remain a significant issue, emphasizing the importance of adhering to established programming standards like CERT guidelines.

KW - Morello/CHERI exploitation

KW - Porting efforts

KW - CERT guidelines

UR - https://eurosp2024.ieee-security.org/index.html

U2 - 10.1109/EuroSP60621.2024.00028

DO - 10.1109/EuroSP60621.2024.00028

M3 - Conference Contribution (Conference Proceeding)

SN - 979-8-3503-5426-3

T3 - IEEE European Symposium on Security and Privacy

SP - 381

EP - 397

BT - 2024 IEEE 9th European Symposium on Security and Privacy (EuroS&P)

PB - IEEE Computer Society

Y2 - 8 July 2024 through 12 July 2024

ER -

Porting to Morello: An In-depth Study on Compiler Behaviors, CERT Guideline Violations, and Security Implications

Abstract

Publication series

Conference

Bibliographical note

Keywords

Access to Document

Handle.net

Other files and links

Fingerprint

Cite this