Google has adopted a technology produced by chip designer Arm to target one of the most popular forms of vulnerability in the Android ecosystem.
Memory safety bugs, which are common in C and C++ programs, comprised more than half of the safety bugs in Android 9, according to a post by Google on Friday. They are often hard to diagnose, leading to unresolved bugs and unreliable software.
Google has agreed to use a hardware-level feature called memory tagging extensions (MTE) in Arm chip designs.
MTE detects two kinds of memory safety violations: spatial and temporal. The first occurs when a program tries to access an object outside its allowed memory space (such as a buffer overflow). The second happens when a program tries to access memory after it is supposed to (such as a use after free bug). These kinds of bugs show up frequently in programs on mobile and other platforms.
MTE spots memory safety violations using what Arm calls a lock-and-key approach to memory access, in which it only grants access if a key used by the program matches its lock.
MTE makes it easier to catch memory bugs before deployment during the testing and fuzzing stage, Arm said in a blog post on Monday.
One of the most interesting features of MTE is that it can scan software before and after deployment, using two modes. Precise mode provides more detailed data about the memory violation and would be suitable for pre-deployment scans. Google plans to let its app developers turn on MTE scanning when they submit their apps to Google Play.
Imprecise mode provides less information on the memory violation but also uses less CPU power. This is more appropriate for always-on deployments, meaning those deployments that could run all the time in Android phones to prevent memory errors. Google will make MTE an Android feature and hopes to defeat 90% of memory-based exploits using the technology, it said.