| https://twitter.com/udunadan | |
| age key | age1cvckqvwfqcx76mnppys8zleaxjwrnp7s7upktlydkhh7l8wns5ws9qpad4 |
| old posts | https://ioc.exchange/@udunadan |
Strengthening the Shield: MTE in Heap Allocators
https://www.darknavy.org/blog/strengthening_the_shield_mte_in_memory_allocators/
Introduction In 2018, with the release of ARMv8.5-A, a brand new chip security feature MTE (Memory Tagging Extensions) emerged. Five years later, in 2023, the first smartphone to support this feature was released — Google Pixel 8 — marking the official entry of MTE into the consumer market. Although this feature is not yet enabled by default, developers can turn it on themselves for testing. As a powerful defense against memory corruption, there has not yet been a comprehensive analysis of MTE’s defensive boundaries, capabilities, and its impact on performance on the internet.
While it's common to bash vendors for their incorrect responses and evaluations of bug reports, I'd argue that the same level of absurdity happens with researchers as well. And to judge that you don't have to be a NSO team lead; just make up a scenario of using a bug yourself.
Say you have an unstable PoC that reproduces once out of 1000 times, works only on version 69.420.1.0.1 but not 1.0.0, relies on experimental features, requires a couple of other bugs to get to a valuable code exec. If you went blackhat, how much money would that make you? I guess, not much. And imagine writing and stabilizing it for all versions in use there. And a whole lot of other things which get obvious once you put yourself into a client position. Many researchers don't, and that puts them close to vendors doing inaccurate risk assessment.
When trying to learn a topic (for example, a memory allocator) or acquire a skill (a debugger scripting), it might turn out that nothing stays in your head after that. That's because this was uncalled for, and when you learn only when needed, that's what cements knowledge.
Let your learning process follow your needs. They are a great measure for resource allocation.
mistymntncop
