Does Pixel 8 have advanced memory protection / MTE?

v0ila

There was a lot of speculation that the Pixel 8 would come with memory tagging and "advanced memory protection" thanks to the new Armv9 chip. Now that we have the phone, does anyone know if they actually implemented it?

Titan_M2

Hardware support is present, GrapheneOS will implement the software side.

v0ila

Titan_M2 Thank you. I've been reading up on MTE. For people who plan on using their phones for another 5 years, does not having MTE present a large security risk?

Titan_M2

v0ila does not having MTE present a large security risk?

Not a risk, simply an improvement older phones won't benefit from.

v0ila

Titan_M2 If MTE doesn't solve a noticeable risk, then why is it such a big deal that it's being implemented in the 8?

Murcielago

Titan_M2

I am not a developer and cannot judge how big the risk really is.

But if I understand it correctly, memory saftey seems to be quite important and related issues seem to be responsible for a lot of security vulnerabilities. According to Google's Chromium project, around 70% of all serious security incidents are due to memory safety issues. MTE seems to address these issues and thus to mitigate a lot of current security threats.

A helpful article with more information can be found here.

ve3jlg

Murcielago But if I understand it correctly, memory saftey seems to be quite important

Yet GrapheneOS users are increasingly advised here to disable existing memory protection in GOS so that their apps will run and not crash.

Oct735

Ah, seems like Pixel 8 and 8 Pro does have MTE! But it's in the developer section.
MTE is a hardware security feature that allows for finding and/or mitigating certain type of memory safety bugs (and these type of bugs contributes to majority of security vuln in Android)

de0u

ve3jlg GrapheneOS users are increasingly advised here to disable existing memory protection in GOS so that their apps will run and not crash.

The reason why people want to add software and hardware hardening to memory is because lots of apps have bugs related to improper use of memory. When a legitimate hardening tool trips, the app almost certainly has a bug, and there is a fair chance any given memory bug is exploitable.

Users might choose to delete the app and report the bug to the developer, and the developer might choose to fix the bug. But that doesn't always happen.

Users might also choose to disable the tool in order to use the app (hopefully also reporting the bug to the developer). This doesn't mean the app doesn't have a problem, and it also doesn't mean that the tool is a bad idea.

It seems plausible that if/when Google turns MTE on for Pixel 8 devices running their OS then a lot of developers will be incentivized to fix genuine and exploitable bugs in apps.

Overall I don't see how Google or GrapheneOS or forum users (or even app authors) are doing anything wrong as this improvement process unfolds.

Please note that I do not speak for the GrapheneOS project.

matchboxbananasynergy

ve3jlg Members of the community generally try to do a good job of explaining what disabling something like hardened_malloc means, and explaining that their app is not working not due to a quirk of GrapheneOS, but rather because an important and tangible exploit protection feature is making the app crash intentionally.

There used to be a time when there was no toggle to disable hardened_malloc for a specific app on GrapheneOS, and I am sure that if that was still the case, you would instead be making posts about how GrapheneOS makes it difficult to use the apps you need to use, and why can't they make it optional.

People can choose to use the compatibility toggles that GrapheneOS provides if they want to accept the risk and use an app with a memory corruption bug, or they can simply uninstall the app and not use it. Better yet, they should report the issue so that it can be fixed, as it was recently done with a memory corruption issue in the media_kit dart library, which was making Aves Gallery, an app that uses said library to crash when hardened_malloc was enabled.

ve3jlg

matchboxbananasynergy you would instead be making posts about how GrapheneOS makes it difficult to use the apps you need to use, and why can't they make it optional.

No, I wouldn't. I well understand the implications of a memory corruption software defect, which is the correct term. Defects which can lead to loss of personal privacy should not be called the cutesy term "bug". but "software defect". There might be fewer ones if their creators were held more accountable or embarrassed more.

Was that a bridge failure or "steel corruption bug" from rust injection?

I am glad you cited the crash problem with Aves, which I personally encountered. I went to github, saw that the problem had already been reported and reproduced and was being worked on. I also saw how I could avoid triggering it until a new release was issued. At that point I did not need to panic or even invoke the GrapheneOS Exploit protection compatability.

matchboxbananasynergy

Initial MTE support in GrapheneOS is now available:

https://grapheneos.org/releases#2023103000