What is Memory Tagging Extension (MTE)?

An Arm extension added in Armv8.5-A. A 4-bit tag is attached to every 16 bytes of memory and a 4-bit tag is also placed in the upper bits of the pointer, and the CPU checks on every access whether the two match. Use of memory after it has been freed and out-of-bounds accesses can be found probabilistically at low cost.

Japanese name: MTE(メモリタギング拡張)

Memory Tagging Extension (MTE) appears in 1 practice question across 1 topic, including Hardware Security: Advanced Topics and Trends.

Field: Hardware Security: Advanced Topics and Trends

How tags are compared

When memory is allocated, the allocator sets the memory-side tag for every 16 bytes of the region and returns a pointer with the same value in its upper bits (the part not used for address translation). On every load and store the CPU compares the pointer's tag with the tag of the memory accessed and treats a mismatch as an error. If the tags are changed when a region is freed, an access to the freed region through an old pointer can be detected. The memory-side tags are stored separately from the data.

Probabilistic detection

Because a tag has 4 bits, there are only 16 values, and the probability that a randomly chosen tag matches by chance is 1/16. That is, a single erroneous access is missed with a probability of about 6% and caught about 94% of the time. Allocation strategies such as always giving adjacent regions different tags can make overflows into a neighbouring region always detectable. Storing the tags needs extra memory of about 4/128 = 3.125% of the capacity.

Checking modes

Synchronous mode raises an exception immediately on a mismatch and identifies the faulting instruction, which suits development and critical code, but costs somewhat more. Asynchronous mode records the error and reports it later, which costs less and suits collecting errors from many devices in the field. Depending on the purpose, it is used both for checking during development and for hindering attacks on shipped devices.

Try it: questions about Memory Tagging Extension (MTE)

In Arm MTE (Memory Tagging Extension), a 4-bit tag is attached to every 16 bytes of memory and a 4-bit tag is also placed in the upper bits of the pointer, and the CPU checks on every access whether the two match. Consider the error of accessing a freed region through an old pointer to it. If the new tag given when the region is reallocated is chosen uniformly at random from the 16 possibilities, what is the probability that the tags match by chance and the error is missed?

A1/16 (about 6.3%)
B1/4 (25%)
C15/16 (about 93.8%)

Show answer and explanation

Answer: A. 1/16 (about 6.3%)

A tag has 4 bits, so it can take 2⁴ = 16 values. If the new tag is chosen uniformly from the 16 values, the probability that it matches the old pointer's tag by chance is 1/16 = 6.25% (about 6.3%), and in the remaining 15/16 of cases the mismatch is detected. Even a single access is caught with a probability of about 94%, so errors can be found while running on many devices and attacks can be made harder. If allocation always gives adjacent regions different tags, overflows into a neighbouring region are always detected.

FAQ

Where is MTE used?

As of the mid-2020s, some smartphone SoCs support it, and OSes and memory allocators are enabling it for development-time checking and to make attacks harder. Both supporting hardware and supporting software are needed.

Does MTE stop attacks that exploit memory errors?

It catches many errors and makes attacks harder, but tags can match by chance, and its effect drops if tag values are guessed or leaked. Because detection is probabilistic, it is combined with mechanisms such as CHERI or with memory-safe languages where deterministic guarantees are required.

Questions that mention Memory Tagging Extension (MTE) (1)

In Arm MTE (Memory Tagging Extension), a 4-bit tag is attached to every 16 bytes of memory and a 4-bit tag is also placed in the upper bits of the pointer, and the CPU checks on every access whether the two match. Consider the error of accessing a freed region through an old pointer to it. If the new tag given when the region is reallocated is chosen uniformly at random from the 16 possibilities, what is the probability that the tags match by chance and the error is missed?

Books on Hardware Security: Advanced Topics and Trends Ad

Search Amazon for semiconductor Hardware Security: Advanced Topics and Trends

As an Amazon Associate I earn from qualifying purchases.

Back to the glossary