Interpreter Memory Safety via Differential Fuzzing with a CHERI on Top

Sun, 03 May 2026 00:00:00 +0000

Abstract

Memory safety is a critical issue in embedded systems. Although high-level languages such as MicroPython simplify IoT development, their C-based runtimes remain vulnerable to memory errors triggered by Python code or native extensions. CHERI (Capability Hardware Enhanced RISC Instructions) provides hardware-enforced memory safety, but its effectiveness in exposing latent bugs in real-world interpreters remains underexplored.

We present diffCHERI:FruitFly, a differential testing framework for systematically uncovering memory defects in MicroPython across conventional x86/Arm platforms and CHERI-enabled Arm Morello hardware. Our framework mines historic vulnerabilities from diverse Python runtimes to extract recurring stress patterns, uses a large language model to generate new test programs, and applies Concrete Syntax Tree (CST) mutation to diversify inputs.

In 24-hour automated testing, diffCHERI:FruitFly executed 8,189 generated programs on MicroPython v1.20 and the development branch, identifying 40 distinct defects in the conventional build and 51 in the CHERI port. Memory errors that caused silent corruption or weak symptoms on conventional hardware were converted into precise capability faults on CHERI.

These results show that CHERI not only reduces the attack surface, but also provides an effective memory-safety oracle for revealing latent vulnerabilities in embedded interpreters.

Kai Feng | Intelligent Systems Software Lab

Interpreter Memory Safety via Differential Fuzzing with a CHERI on Top