Technology
Temporal memory safety
Temporal memory safety prevents code from continuing to use an object after its lifetime has ended.
Why it matters
The distinction matters because bounds can be correct while a pointer is stale and now refers to reallocated storage.
In brief
What happens when software uses memory after it should have stopped?
Temporal memory safety prevents code from continuing to use an object after its lifetime has ended. CHERI’s unforgeable capabilities provide a strong foundation, but revoking all outstanding capabilities to freed memory requires additional allocator, runtime or system mechanisms.
Key considerations
1. End lifetime
The allocator or object system marks memory as no longer belonging to the old object.
2. Revoke
A temporal-safety mechanism prevents outstanding capabilities from authorising access to the reused memory.
3. Recover
The system detects invalid use and applies an appropriate fault or containment policy.
Evidence and caveats
Base CHERI spatial checks alone do not guarantee temporal safety. State which revocation mechanism, scope and performance trade-off a system uses.
Use the exact architecture and software specification implemented by the target. Separate architectural guarantees from system-level outcomes.