EXPLORING GRAPHENEOS SECURE ALLOCATOR: HARDENED MALLOC

Summary from the TLDR InfoSec newsletter

GrapheneOS features a hardened malloc, a memory allocator that uses ARM Memory Tagging Extension (MTE) to assign tags to memory regions and detect corruption, effectively preventing heap overflows and use-after-free attacks. Its two-stage quarantine system, which involves randomized and FIFO queues, makes exploiting freed memory difficult by requiring attackers to perform thousands of free operations. Large allocations are secured through guard pages, address space randomization, and the separation of metadata from user data, all of which enhance security.