What CHERI changes

Why it matters

The underlying bug may remain, but the attempted invalid access can fault before it reaches unrelated memory, and a compromised component can be given less authority.

In brief

What does CHERI change inside a computer, and why does that matter to me?

CHERI changes the way a processor represents and checks authority to memory. Instead of treating a pointer as an address alone, a capability carries protected bounds, permissions and validity that hardware checks when software uses it.

Text-only capability check

1. Software attempts to access a memory address.
2. The processor checks whether the capability is valid.
3. It checks whether the address is inside the capability bounds.
4. It checks whether the requested action is permitted.
5. A valid request continues. An invalid request faults at the point of use and can be contained at a compartment boundary.

Key considerations

1. Pointer protection

Capabilities constrain where code may access and what operations it may perform.

2. Fault at use

Invalid, out-of-bounds or disallowed accesses are rejected according to the architecture.

3. Containment

Narrow delegated capabilities support compartments with smaller blast radii.

Evidence and caveats

CHERI does not decide correct application policy, prevent every temporal error by itself or address all attacks. System design and complementary controls remain necessary.

Use evidence from a named system or source and keep claims proportionate. CHERI is one layer in a broader secure-design strategy.

Primary routes

• University of Cambridge CHERI