  Several open-source memory allocators have been ported to CHERI, a hardware
capability platform. In this paper we examine the security and performance of
these allocators when run under CheriBSD on Arm's experimental Morello
platform. We introduce a number of security attacks and show that all but one
allocator are vulnerable to some of the attacks - including the default
CheriBSD allocator. We then show that while some forms of allocator performance
are meaningful, comparing the performance of hybrid and pure capability (i.e.
'running in non-CHERI vs. running in CHERI modes') allocators does not appear
to be meaningful. Although we do not fully understand the reasons for this, it
seems to be at least as much due to factors such as immature compiler
toolchains as it is due to the effects of capabilities on hardware.
