While the CHERI instruction-set architecture extensions for capabilities enable strong spatial memory safety, CHERI lacks built-in temporal safety, particularly for heap allocations. Prior attempts to augment CHERI with temporal safety fall short in terms of scalability, memory overhead, and incomplete security guarantees due to periodical sweeps of the system's memory to individually revoke stale capabilities. We address these limitations by introducing colored capabilities that add a controlled form of indirection to CHERI's capability model. This enables provenance tracking of capabilities to their respective allocations via a hardware-managed provenance-validity table, allowing bulk retraction of dangling pointers without needing to quarantine freed memory. Colored capabilities significantly reduce the frequency of capability revocation sweeps while improving security. We realize colored capabilities in PICASSO, an extension of the CHERI-RISC-V architecture on a speculative out-of-order FPGA softcore (CHERI-Toooba). We also integrate colored-capability support into the CheriBSD OS and CHERI-enabled Clang/LLVM toolchain. Our evaluation shows effective mitigation of use-after-free and double-free bugs across all heap-based temporal memory-safety vulnerabilities in NIST Juliet test cases, , real-world CVEs, only a small performance overhead on SPEC CPU benchmarks (5% g.m.), less latency, and more consistent performance in long-running SQLite, PostgreSQL, and gRPC workloads compared to prior work.

翻译：虽然CHERI指令集架构扩展通过能力机制实现了强大的空间内存安全，但其缺乏内置的时间安全保护，尤其针对堆内存分配。先前为CHERI增加时间安全保护的努力在可扩展性、内存开销以及安全保证完整性方面存在不足——系统需定期扫描内存以逐个撤销过期能力。我们通过引入彩色能力（colored capabilities）来解决这些局限，为CHERI的能力模型增加受控间接寻址机制。该机制通过硬件管理的来源-有效性表（provenance-validity table）追踪能力与其对应分配的来源关系，使得无需隔离已释放内存即可批量撤回悬垂指针。彩色能力显著降低了能力撤销扫描的频率，同时提升了安全性。我们在PICASSO（CHERI-RISC-V架构的扩展，部署于推测乱序FPGA软核CHERI-Toooba）中实现了彩色能力，并将其集成到CheriBSD操作系统和启用CHERI的Clang/LLVM工具链中。评估表明，该方法能有效缓解所有基于堆的时间内存安全漏洞：在NIST Juliet测试用例和真实世界CVE中消除释放后使用及双重释放错误，相比先前工作在SPEC CPU基准测试中仅引入较小性能开销（几何平均5%），并且在长期运行的SQLite、PostgreSQL和gRPC工作负载中展现出更低的延迟和更稳定的性能。