TLDR Tech / InfoSec
CHERIoT-Ibex: Closing the door on memory safety vulnerabilities with hardware-enforced protection
Microsoft's CHERIoT-Ibex became the first open-source production-quality implementation of the CHERIoT ISA certified by the CHERI Alliance, extending LowRISC's 32-bit RISC-V Ibex core with capability-based hardware-enforced spatial and temporal memory safety plus fine-grained compartmentalization. The core targets embedded and IoT workloads where roughly 70 percent of Microsoft-assigned CVEs stem from memory safety defects in C/C++, and achieves its guarantees at power and area parity with low-cost microcontrollers. For defenders building tightly integrated firmware, the design constrains blast radius so a compromise in an exposed networking stack cannot pivot into privileged init or telemetry components on the same die.
Read the full story