  Memory safety in complex applications implemented in unsafe programming
languages such as C/C++ is still an unresolved problem in practice. Many
different types of defenses have been proposed in the past to mitigate this
problem. The most promising next step is a tighter integration of the hardware
and software level: modern mitigation techniques are either accelerated using
hardware extensions or implemented in the hardware by extensions of the ISA. In
particular, memory tagging, as proposed by ARM or SPARC, promises to solve many
issues for practical memory safety. Unfortunately, Intel x86-64, which
represents the most important ISA for both the desktop and server domain, lacks
support for hardware-accelerated memory tagging, so memory tagging is not
considered practical for this platform.
  In this paper, we present the design and implementation of an efficient,
software-only pointer tagging scheme for Intel x86-64 based on a novel metadata
embedding scheme. The basic idea is to alias multiple virtual pages to one
physical page so that we can efficiently embed tag bits into a pointer.
Furthermore, we introduce several optimizations that significantly reduce the
performance impact of this approach to memory tagging. Based on this scheme, we
propose a novel use-after-free mitigation scheme, called xTag, that offers
better performance and strong security properties compared to state-of-the-art
methods. We also show how double-free vulnerabilities can be mitigated. Our
approach is highly compatible, allowing pointers to be passed back and forth
between instrumented and non-instrumented code without losing metadata, and it
is even compatible with inline assembly. We conclude that building exploit
mitigation mechanisms on top of our memory tagging scheme is feasible on Intel
x86-64, as demonstrated by the effective prevention of use-after-free bugs in
the Firefox web browser.
