# US 2021/0240638 A1 · Mitigating security vulnerabilities with memory allocation markers in cryptographic computing systems > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0240638 A1 - Document ID: US20210240638A1 - Status: Published application - Kind: A1 - Application number: 17/214,222 - Filed: 2021-03-26 - Published: 2021-08-05 - Earliest claimed: 2020-08-14 - Assignees: Intel Corporation - Applicants: Intel Corporation - Inventors: Sergej Deutsch; David M. Durham; Karanvir S. Grewal; Michael D. LeMay; Michael E. Kounavis - Web page: https://patentgrep.com/patent/US20210240638A1 ## CPC - H04L 9/0618: {Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation} - G06F 9/5016: {the resource being the memory} - G06F 12/121: using replacement algorithms - G06F 12/1408: {by using cryptography (for digital transmission H04L9/00)} - G06F 12/1441: {for a range} - G06F 12/1458: {by checking the subject access rights} - G06F 12/1466: {Key-lock mechanism} - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC} - G06F 2212/1052: Security improvement - G06F 2212/7207: management of metadata or control data - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Technologies disclosed herein provide one example of a processor that includes a register to store a first encoded pointer for a first memory allocation for an application and circuitry coupled to memory. Size metadata is stored in first bits of the first encoded pointer and first memory address data associated with the first memory allocation is stored in second bits of the first encoded pointer. The circuitry is configured to determine a first memory address of a first marker region in the first memory allocation, obtain current data from the first marker region at the first memory address, compare the current data to a reference marker stored separately from the first memory allocation, and determine that the first memory allocation is in a first state in response to a determination that the current data corresponds to the reference marker. ## Claims ### Claim 1 A processor, comprising: a register to store a first encoded pointer for a first memory allocation for an application, wherein size metadata is stored in first bits of the first encoded pointer and first memory address data associated with the first memory allocation is stored in second bits of the first encoded pointer; and circuitry coupled to a memory, the circuitry to: determine a first memory address of a first marker region in the first memory allocation; obtain current data from the first marker region at the first memory address; compare the current data to a reference marker stored separately from the first memory allocation; and determine that the first memory allocation is in a first state in response to a determination that the current data corresponds to the reference marker. ### Claim 2 (depends on 1) The processor of claim 1, wherein the first state indicates that at least a portion of the first memory allocation overlaps with a previous memory allocation and that a first keystream to be used for cryptographic operations on first objects to be stored in the first memory allocation is equivalent to a second keystream previously used for cryptographic operations on second objects currently stored in the previous memory allocation. ### Claim 3 (depends on 1) The processor of claim 1, wherein the circuitry is further to: in response to determining that the first memory allocation is in the first state, prevent access to contents currently stored in the first memory allocation. ### Claim 4 (depends on 3) The processor of claim 3, wherein to prevent access to the contents currently stored in the first memory allocation is to include replacing the contents with replacement data. ### Claim 5 (depends on 3) The processor of claim 3, wherein to prevent access to the contents currently stored in the first memory allocation is to include obtaining an alternate memory allocation for the application and generating an alternate encoded pointer for the alternate memory allocation, wherein the alternate encoded pointer is to include alternate memory address data that is different than the first memory address data for first memory allocation. ### Claim 6 (depends on 3) The processor of claim 3, wherein to prevent access to the contents currently stored in the first memory allocation is to include modifying version metadata in the first encoded pointer. ### Claim 7 (depends on 3) The processor of claim 3, wherein the circuitry is further to: in response to a first memory allocation request for the application, perform a memory allocation operation including obtaining the first memory allocation and generating the first encoded pointer; prior to the first memory allocation request, in response to a memory deallocation request for a second memory allocation, store the reference marker at a second marker region in the second memory allocation; and deallocate the second memory allocation. ### Claim 8 (depends on 7) The processor of claim 7, wherein the circuitry is further to: prior to storing the reference marker in the second marker region in the second memory allocation, encrypt the reference marker based, at least in part, on a tweak including one or more bits from a second encoded pointer for the second memory allocation. ### Claim 9 (depends on 7) The processor of claim 7, wherein the first marker region and the second marker region are determined to be located at the first memory address in the memory based on the first memory allocation being assigned to a same slot defined in the memory to which the second memory allocation was previously assigned, wherein the slot is aligned with a power of two boundary, and wherein the first marker region and the second marker region include a midpoint of the slot. ### Claim 10 (depends on 7) The processor of claim 7, wherein the first memory allocation is a first stack frame allocated for a first function of the application, wherein the second memory allocation is a second stack frame allocated for a second function of the application, and wherein to store the reference marker at the second marker region is to replace a return address for the second function. ### Claim 11 (depends on 1) The processor of claim 1, wherein the first marker region includes a midpoint of a slot defined in the memory, wherein the slot is aligned with a power of two boundary and sized to contain the first memory allocation. ### Claim 12 (depends on 11) The processor of claim 11, wherein to determine that the current data corresponds to the reference marker is to include determining at least one of: a lower portion of the reference marker matches a lower portion of the current data; or an upper portion of the reference marker matches an upper portion of the current data. ### Claim 13 (depends on 1) The processor of claim 1, wherein to obtain the current data from the first marker region of the first memory allocation is to include: reading encrypted data from the first marker region at the first memory address of the first memory allocation; and performing a decryption operation on the encrypted data to generate the current data, wherein input to the decryption operation includes a tweak, the tweak including the size metadata and at least a portion of the first memory address data in the first encoded pointer. ### Claim 14 (depends on 1) The processor of claim 1, wherein the first state indicates that the first memory allocation has not been initialized. ### Claim 15 (depends on 14) The processor of claim 14, wherein the first memory address of the first marker region is determined in response to a memory access request, wherein the circuitry is further to: in response to the determination that the current data corresponds to the reference marker, load initialization data into a register to perform the memory access request. ### Claim 16 (depends on 15) The processor of claim 15, wherein the initialization data is one of all bit values being zeros, all bit values being ones, a deterministic pattern of bit values, or a random pattern of bit values. ### Claim 17 (depends on 15) The processor of claim 15, wherein the circuitry is further to: in response to a first memory allocation request for the application, perform a memory allocation operation including obtaining the first memory allocation and generating the first encoded pointer; and prior to outputting the first encoded pointer to the application, encrypt the reference marker based, at least in part, on a tweak including one or more bits from the first encoded pointer and store the encrypted reference marker in the first marker region of the first memory allocation. ### Claim 18 (depends on 1) The processor of claim 1, wherein the reference marker is selected during one of: a first initialization process of a boot operation for the processor; a second initialization process of a virtual machine; a third initialization process of the application; a fifth initialization process of variables in a function called in the application; or a memory deallocation request. ### Claim 19 (depends on 1) The processor of claim 1, wherein the reference marker is stored separately from the first memory allocation in one of main memory, cache memory, a register, or a separate storage unit connected to the processor. ### Claim 20 One or more machine-readable media including instructions stored therein that, when executed, cause a processor to: generate a first encoded pointer for a first memory allocation for an application, wherein size metadata and first memory address data associated with the first memory allocation are stored in the first encoded pointer; determine a first memory address of a first marker region in the first memory allocation; obtain current data from the first marker region at the first memory address; compare the current data to a reference marker stored separately from the first memory allocation; and determine that the first memory allocation is in a first state in response to a determination that the current data corresponds to the reference marker. ### Claim 21 (depends on 20) The machine-readable media of claim 20, wherein the instructions, when executed, cause the processor further to: in response to determining that the first memory allocation is in the first state, prevent access to contents currently stored in the first memory allocation. ### Claim 22 (depends on 20) The machine-readable media of claim 20, wherein the instructions, when executed, cause the processor further to: in response to a first memory allocation request for the application, perform a memory allocation operation including obtaining the first memory allocation; prior to the first memory allocation request, in response to a memory deallocation request for a second memory allocation, store the reference marker at a second marker region in the second memory allocation; and deallocate the second memory allocation. ### Claim 23 (depends on 20) The machine-readable media of claim 20, wherein the first marker region includes a midpoint of a slot defined in memory, wherein the slot is aligned with a power of two boundary and sized to contain the first memory allocation. ### Claim 24 A method comprising: generating, by a processor, a first encoded pointer for a first memory allocation for an application, wherein size metadata and first memory address data associated with the first memory allocation are stored in the first encoded pointer; determining a first memory address of a first marker region in the first memory allocation; obtaining current data from the first marker region at the first memory address; comparing the current data to a reference marker stored separately from the first memory allocation; and determining that the first memory allocation is in a first state in response to a determination that the current data corresponds to the reference marker. ### Claim 25 (depends on 24) The method of claim 24, further comprising: in response to determining that the first memory allocation is in the first state, preventing access to contents currently stored in the first memory allocation.