# TikTag: Breaking ARM's Memory Tagging Extension with Speculative Execution

**Authors:** Juhee Kim, Jinbum Park, Sihyeon Roh, Jaeyoung Chung, Youngjoo Lee, Taesoo Kim, Byoungyoung Lee  
**arXiv:** [2406.08719](https://arxiv.org/abs/2406.08719)  
**Date:** 2024-06-13  
**Summary page:** https://www.summarizepaper.com/en/paper/2406.08719v1/

## Key points

- ARM Memory Tagging Extension (MTE) introduced in ARMv8.5-A architecture to detect memory corruption vulnerabilities
- Recent research uncovers security risks from speculative execution attacks against MTE
- TikTag gadgets identified for leaking MTE tags through speculative execution, increasing success rate of memory corruption attacks
- Proposed defense mechanisms to mitigate impact of TikTag gadgets on system security

## Summary

, , , , 

The ARM Memory Tagging Extension (MTE) is a hardware feature introduced in the ARMv8.5-A architecture to detect memory corruption vulnerabilities. MTE offers low overhead and is an attractive solution for improving C/C++ software security. However, recent research has uncovered potential security risks posed by speculative execution attacks against MTE. In their study titled "TikTag: Breaking ARM’s Memory Tagging Extension with Speculative Execution," researchers Juhee Kim, Jinbum Park, Sihyeon Roh, Jaeyoung Chung, Youngjoo Lee, Taesoo Kim, and Byoungyoung Lee delve into the vulnerabilities of MTE. They identify new TikTag gadgets capable of leaking MTE tags from arbitrary memory addresses through speculative execution. These TikTag gadgets enable attackers to bypass the probabilistic defense mechanisms of MTE, significantly increasing the success rate of memory corruption attacks. The researchers demonstrate that TikTag gadgets can be used to bypass MTE-based mitigations in real-world systems such as Google Chrome and the Linux kernel. Experimental results show that TikTag gadgets can successfully leak an MTE tag with a success rate exceeding 95% in less than 4 seconds. To address these security risks, the researchers propose new defense mechanisms aimed at mitigating the impact of TikTag gadgets on system security. Comparing their work to previous research efforts like StickyTags, which proposed deterministic tagging as a defense mechanism against tag leakage, this study focuses on enhancing random tagging-based MTE defenses. By analyzing and addressing the root causes of both TIKTAG-v1 and TIKTAG-v2 gadgets, the researchers aim to strengthen existing hardware and software defenses against speculative execution attacks targeting MTE. Overall, this study sheds light on the critical importance of understanding and mitigating security risks associated with emerging hardware features like MTE in order to enhance overall system security and protect against memory corruption vulnerabilities effectively.