In Arm MTE (Memory Tagging Extension), a 4-bit tag is attached to every 16 bytes of memory and a 4-bit tag is also placed in the upper bits of the pointer, and the CPU checks on every access whether the two match. Consider the error of accessing a freed region through an old pointer to it. If the new tag given when the region is reallocated is chosen uniformly at random from the 16 possibilities, what is the probability that the tags match by chance and the error is missed?

Answer: A. 1/16 (about 6.3%)

A tag has 4 bits, so it can take 2⁴ = 16 values. If the new tag is chosen uniformly from the 16 values, the probability that it matches the old pointer's tag by chance is 1/16 = 6.25% (about 6.3%), and in the remaining 15/16 of cases the mismatch is detected. Even a single access is caught with a probability of about 94%, so errors can be found while running on many devices and attacks can be made harder. If allocation always gives adjacent regions different tags, overflows into a neighbouring region are always detected.

• A. Correct. It is the probability of matching one of the 2⁴ = 16 values.
• B. This divides by 4, the number of tag bits. The number of values a tag can take is 2⁴ = 16.
• C. This is the probability that the mismatch is detected (1 − 1/16).