Technology
Plain-language overview
CHERI turns a pointer from a bare address into a protected capability whose validity, bounds and permissions are checked by the processor.
Why it matters
A programming error may still happen, but an invalid memory access can be blocked at the point of use and a component can be given less authority in the first place.
In brief
Conventional software often represents a pointer as an address. CHERI represents pointer authority with a protected capability: an address plus limits such as bounds, permissions and validity. The processor checks those limits whenever the capability is used.
Text-only capability check
- Software attempts to access a memory address.
- The processor checks whether the capability is valid.
- It checks whether the address is inside the capability bounds.
- It checks whether the requested action is permitted.
- A valid request continues. An invalid request faults at the point of use and can be contained at a compartment boundary.
Key considerations
1. Carry authority
The pointer says not only where, but which memory region and operations are allowed.
2. Check in hardware
The processor rejects invalid, out-of-bounds or disallowed uses according to the architecture.
3. Contain components
Narrow capabilities support compartments that limit what compromised code can reach.
Evidence and caveats
CHERI focuses on memory access and authority. Logic flaws, unsafe protocols, stolen credentials and misconfiguration still need other controls.
Use the exact architecture and software specification implemented by the target. Separate architectural guarantees from system-level outcomes.