Exploring GrapheneOS secure allocator: Hardened Malloc
11 hours ago
- #GrapheneOS
- #Memory Allocator
- #Security
- GrapheneOS introduces hardened malloc, a security-focused memory allocator designed to protect against memory corruption vulnerabilities.
- Hardened malloc leverages ARM's Memory Tagging Extension (MTE) to detect and prevent memory corruption, especially on compatible devices like Google Pixel smartphones.
- The allocator uses a two-stage quarantine system for freed memory slots, significantly complicating use-after-free exploits.
- Small allocations are categorized into 49 size classes, each with its own metadata and memory region, enhancing isolation and security.
- Large allocations are dynamically mapped with random-sized guard pages, adding a layer of non-determinism and protection against overflows.
- The allocator's design includes clear and concise implementation, facilitating audit and maintenance.
- Hardened malloc's integration with GrapheneOS provides a higher level of security compared to standard Android allocators like scudo.