Dynamic Vulnerability Patching for Heterogeneous Embedded Systems Using Stack Frame Reconstruction

• URL: http://arxiv.org/abs/2509.10213v1
• Date: Fri, 12 Sep 2025 13:00:45 GMT
• Title: Dynamic Vulnerability Patching for Heterogeneous Embedded Systems Using Stack Frame Reconstruction
• Abstract summary: Existing dynamic vulnerability patching techniques are not well-suited for embedded devices.<n>We propose a hot patching framework called StackPatch that facilitates patch development based on stack frame reconstruction.<n>We tested StackPatch on embedded devices featuring three major microcontroller (MCU) architectures: ARM, RISC-V, and Xtensa.
• Score: 10.905694063940425
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Existing dynamic vulnerability patching techniques are not well-suited for embedded devices, especially mission-critical ones such as medical equipment, as they have limited computational power and memory but uninterrupted service requirements. Those devices often lack sufficient idle memory for dynamic patching, and the diverse architectures of embedded systems further complicate the creation of patch triggers that are compatible across various system kernels and hardware platforms. To address these challenges, we propose a hot patching framework called StackPatch that facilitates patch development based on stack frame reconstruction. StackPatch introduces different triggering strategies to update programs stored in memory units. We leverage the exception-handling mechanisms commonly available in embedded processors to enhance StackPatch's adaptability across different processor architectures for control flow redirection. We evaluated StackPatch on embedded devices featuring three major microcontroller (MCU) architectures: ARM, RISC-V, and Xtensa. In the experiments, we used StackPatch to successfully fix 102 publicly disclosed vulnerabilities in real-time operating systems (RTOS). We applied patching to medical devices, soft programmable logic controllers (PLCs), and network services, with StackPatch consistently completing each vulnerability remediation in less than 260 MCU clock cycles.

Related papers

• Velosiraptor: Code Synthesis for Memory Translation [1.1144160500749258]
  Velosiraptor is a system that automatically generates correct, low-level OS code that programs the memory hardware of a machine.<n>We present Velosiraptor, a system that automatically generates correct, low-level OS code that programs the memory hardware of a machine.
  arXiv  Detail & Related papers  (2026-08-08T07:01:59Z)
• RAVEN: Agentic RAG for Automated Vulnerability Repair [48.8954115363348]
  We propose RAVEN, a scalable, efficient and autonomous framework for automated vulnerability repair.<n>RAVEN integrates an agentic retrieval-augmented generation (RAG) pipeline with controlled iterative repair in a unified framework.<n>RAVEN achieves an overall repair success rate of 83.13%, outperforming all existing state-of-the-art repair frameworks.
  arXiv  Detail & Related papers  (2026-06-21T19:18:06Z)
• Patchlings: Safety-Preserving Flash-Based Hotpatching for Automotive Microcontrollers [2.8577135915003034]
  We introduce Patchlings, the first hotpatching framework designed for compliance, safety, and persistence in automotive systems.<n>It fills the gap in applying hotpatching to automotive systems and fundamentally reduces the mean-time-to-mitigate (MTTM) for vulnerabilities and bugs.<n>Our results demonstrate low overhead (e.g. 3.3 $$s when a patch is applied), small firmware size increase (e.g., as low as 6.34%), and successful patching of different types of real CVEs.
  arXiv  Detail & Related papers  (2026-05-27T00:51:57Z)
• WATSON: Leveraging Data Watchpoints for Shadow Stack Protection on Embedded Systems [2.8498726360118716]
  We present WATSON, an efficient and effective shadow stack solution for embedded systems.<n>It leverages a standard hardware debug unit named data watchpoints for shadow stack protection on embedded systems.<n>We implement a prototype of WATSON on the ARM CortexM architecture, and the concept also applies to other platforms.
  arXiv  Detail & Related papers  (2026-05-09T01:53:15Z)
• Architecture-Aware Multi-Design Generation for Repository-Level Feature Addition [53.50448142467294]
  RAIM is a multi-design and architecture-aware framework for repository-level feature addition.<n>It shifts away from linear patching by generating multiple diverse implementation designs.<n>Experiments on the NoCode-bench Verified dataset demonstrate that RAIM establishes a new state-of-the-art performance.
  arXiv  Detail & Related papers  (2026-03-02T12:50:40Z)
• RMBench: Memory-Dependent Robotic Manipulation Benchmark with Insights into Policy Design [77.30163153176954]
  RMBench is a simulation benchmark comprising 9 manipulation tasks that span multiple levels of memory complexity.<n>Mem-0 is a modular manipulation policy with explicit memory components designed to support controlled ablation studies.<n>We identify memory-related limitations in existing policies and provide empirical insights into how architectural design choices influence memory performance.
  arXiv  Detail & Related papers  (2026-03-01T18:59:59Z)
• Match & Mend: Minimally Invasive Local Reassembly for Patching N-day Vulnerabilities in ARM Binaries [5.645823801022895]
  Low-cost Internet of Things (IoT) devices are increasingly popular but often insecure due to poor update regimes.<n>We propose to patch IoT firmware at the binary level, without requiring vendor support.<n>In particular, we introduce minimally invasive local reassembly, a new technique for automatically patching known (n-day) vulnerabilities in IoT firmware.
  arXiv  Detail & Related papers  (2025-10-16T07:31:42Z)
• CrashFixer: A crash resolution agent for the Linux kernel [58.152358195983155]
  This work builds upon kGym, which shares a benchmark for system-level Linux kernel bugs and a platform to run experiments on the Linux kernel.<n>This paper introduces CrashFixer, the first LLM-based software repair agent that is applicable to Linux kernel bugs.
  arXiv  Detail & Related papers  (2025-04-29T04:18:51Z)
• SMaCk: Efficient Instruction Cache Attacks via Self-Modifying Code Conflicts [5.942801930997087]
  Self-modifying code (SMC) allows programs to alter their own instructions.<n>SMC introduces unique microarchitectural behaviors that can be exploited for malicious purposes.
  arXiv  Detail & Related papers  (2025-02-08T03:35:55Z)
• AutoPatch: Automated Generation of Hotpatches for Real-Time Embedded Devices [8.026313049094147]
  Real-time embedded devices like medical or industrial devices are increasingly targeted by cyber-attacks. Hotpatching is an approach to apply a patch to mission-critical embedded devices without rebooting them. We propose AutoPatch, a new hotpatching technique that automatically generates equivalent hotpatches via static analysis of the official patches.
  arXiv  Detail & Related papers  (2024-08-27T19:11:39Z)
• When Memory Mappings Attack: On the (Mis)use of the ARM Cortex-M FPB Unit [2.828466685313335]
  In recent years we have seen an explosion in the usage of low-cost, low-power microcontrollers in embedded devices. This has been detrimental for security as microcontroller-based systems are now a viable attack target.
  arXiv  Detail & Related papers  (2023-12-20T17:00:43Z)
• SKU-Patch: Towards Efficient Instance Segmentation for Unseen Objects in Auto-Store [102.45729472142526]
  In large-scale storehouses, precise instance masks are crucial for robotic bin picking. This paper presents a new patch-guided instance segmentation solution, leveraging only a few image patches for each incoming new SKU. SKU-Patch yields an average of nearly 100% grasping success rate on more than 50 unseen SKUs in a robot-aided auto-store logistic pipeline.
  arXiv  Detail & Related papers  (2023-11-08T12:44:38Z)
• Theoretical Patchability Quantification for IP-Level Hardware Patching Designs [6.963451130092431]
  We propose a theoretical patchability quantification method to analyze designs at the Register Transfer Level (RTL) Our quantification defines patchability as a combination of observability and controllability so that we can analyze and compare the patchability of IP variations. In experiments, we compare several design options of the same patching architecture and discuss their differences in terms of theoretical patchability.
  arXiv  Detail & Related papers  (2023-11-07T09:02:51Z)
• MCUFormer: Deploying Vision Transformers on Microcontrollers with Limited Memory [76.02294791513552]
  We propose a hardware-algorithm co-optimizations method called MCUFormer to deploy vision transformers on microcontrollers with extremely limited memory. Experimental results demonstrate that our MCUFormer achieves 73.62% top-1 accuracy on ImageNet for image classification with 320KB memory.
  arXiv  Detail & Related papers  (2023-10-25T18:00:26Z)
• Capacity: Cryptographically-Enforced In-Process Capabilities for Modern ARM Architectures (Extended Version) [1.2687030176231846]
  Capacity is a novel hardware-assisted intra-process access control design that embraces capability-based security principles. With intra-process domains authenticated with unique PA keys, Capacity transforms file descriptors and memory pointers into cryptographically-authenticated references. We evaluate our Capacity-enabled NGINX web server prototype and other common applications in which sensitive resources are isolated into different domains.
  arXiv  Detail & Related papers  (2023-09-20T08:57:02Z)
• RAP-Gen: Retrieval-Augmented Patch Generation with CodeT5 for Automatic Program Repair [75.40584530380589]
  We propose a novel Retrieval-Augmented Patch Generation framework (RAP-Gen) RAP-Gen explicitly leveraging relevant fix patterns retrieved from a list of previous bug-fix pairs. We evaluate RAP-Gen on three benchmarks in two programming languages, including the TFix benchmark in JavaScript, and Code Refinement and Defects4J benchmarks in Java.
  arXiv  Detail & Related papers  (2023-09-12T08:52:56Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.