Good News: Less Memory-Safety Related CVEs in FreeBSD Base

[appasquatic]

Hi Guys,


A silver lining here: I was looking around at memory-safety related mitigations for FreeBSD, and came across this:

Bringing memory safety to BSD

It seems like this chap, Brooks Davis, is going to supply his Capability Model work from CheriBSD to FreeBSD in version 16 of the OS. I imagine opnsense will inherit this memory protection system as well. Seems a lot less work than FreeBSD considering wholesale adoption Rust...   

[(MARLOO)]

Good find. Just note that CHERI's hardware-enforced memory safety requires CHERI-capable hardware — mainly Arm Morello or CHERI-RISC-V — not existing x86‑64 systems. So on a regular AMD64/Intel machine it is interesting to follow, but it will not provide those benefits directly..

Morello boards were not generally available for purchase; CHERI-RISC-V/CHERIoT boards are more accessible, but they are development/embedded platforms rather than practical firewall hardware.

[appasquatic]

Ah, I see...
And there I was getting my hopes up!
Thanks for the clarification, though. Fingers crossed that something like this can make it to the world of x86-64, but if I understand you correctly, any mitigation of this type may require specialised hardware support.

[pfry]

[...]Just note that CHERI's hardware-enforced memory safety requires CHERI-capable hardware — mainly Arm Morello or CHERI-RISC-V — not existing x86‑64 systems.[...]

Or ARM or RV. I didn't see ARM's plans offhand, but you're not getting this feature on any commercial hardware for a few years. Their FreeBSD push is interesting.

Also, sounds like another case of "what's old is new again": x86 selectors. Fancier, of course. I don't recall if ARM was among the RISC vendors crapping on strict memory ordering and protection back in the day; the UNIX vendors certainly did. But hey - maybe it'll amount to something.

[appasquatic]

We can only hope!

I think the researchers are showing some foresight in trying to define (and hopefully implement) a technical solution before legislation forces them to adopt something less well considered. I wonder if there is an approach which does not have direct hardware dependencies?

[KulaSekra]

The interesting part is that even if CHERI itself needs dedicated hardware, getting this kind of work into FreeBSD now could still be valuable long term. If a hardware-independent mitigation can eventually cover the existing x86-64 base, that would make the whole thing much more practical for OPNsense users rather than waiting for new firewall hardware to become commonplace.

[appasquatic]

Agreed!

In fact, hardware independent memory safety has to be a candidate for my Christmas wish list.
I did find this (C++ Smart Pointer Discipline or Zig) but it seems there still a lot of rework is required for use of new Zig libraries, or Smart pointers within C++