Patchlings: Safety-Preserving Flash-Based Hotpatching for Automotive Microcontrollers

• URL: http://arxiv.org/abs/2605.27804v1
• Date: Wed, 27 May 2026 00:51:57 GMT
• Title: Patchlings: Safety-Preserving Flash-Based Hotpatching for Automotive Microcontrollers
• Abstract summary: We introduce Patchlings, the first hotpatching framework designed for compliance, safety, and persistence in automotive systems.<n>It fills the gap in applying hotpatching to automotive systems and fundamentally reduces the mean-time-to-mitigate (MTTM) for vulnerabilities and bugs.<n>Our results demonstrate low overhead (e.g. 3.3 $$s when a patch is applied), small firmware size increase (e.g., as low as 6.34%), and successful patching of different types of real CVEs.
• Score: 2.8577135915003034
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: The increasing presence of software in modern automobiles has created a growing need to deliver software updates throughout a vehicle's entire lifespan. Traditional update methods are slow and require months of re-validation to comply with stringent safety standards like ISO 26262. Although hotpatching offers a path to faster updates, existing solutions for real-time embedded systems are unsuitable for the automotive domain: they overlook regulatory compliance, demand extensive safety validation, and lack support for the flash-based Execute-in-Place (XIP) architecture commonly used in automotive electronic control units (ECUs). We introduce Patchlings, the first hotpatching framework designed for compliance, safety, and persistence in automotive systems. It fills the gap in applying hotpatching to automotive systems and fundamentally reduces the mean-time-to-mitigate (MTTM) for vulnerabilities and bugs. We implement and evaluate a complete prototype of Patchlings on an automotive-grade hardware platform, NXP S32K148EVB, with both FreeRTOS and Zephyr. Our results demonstrate low and deterministic overhead (e.g., 3.3 $μ$s when a patch is applied), small firmware size increase (e.g., as low as 6.34%), and successful patching of different types of real CVEs, proving its real-world applicability and effectiveness.

Related papers

• AutoSaddler: Automatic Harness Optimization with Durable Updates from Agent Execution Traces [61.51487329124135]
  AutoSaddler is a framework that formulates harness improvement as an offline learning problem.<n>It iteratively updates the harness using failure signals from mini-batches.<n>Experiments on GAIA2, SWE-Bench Pro, and Terminal-Bench 2.0 show that AutoSaddler substantially improves agent performance.
  arXiv  Detail & Related papers  (2026-08-24T09:45:08Z)
• EVA: Editing for Versatile Alignment against Jailbreaks [85.18411558566851]
  EVA (Editing for Versatile Alignment against Jailbreaks) is a novel framework that pioneers the application of direct model editing for safety alignment.<n> EVA identifies and surgically edits specific neurons responsible for the model's susceptibility to harmful instructions.<n>It effectively neutralizes harmful behaviors without compromising the model's general reasoning capabilities.
  arXiv  Detail & Related papers  (2026-05-14T12:16:10Z)
• Safety Alignment as Continual Learning: Mitigating the Alignment Tax via Orthogonal Gradient Projection [52.551864761088574]
  Large Language Models (LLMs) often incur an alignment tax: safety post-training can reduce general utility.<n>We argue that this tax primarily arises from continual-learning-style forgetting in sequential alignment.<n>We propose Orthogonal Gradient Projection for Safety Alignment (OGPSA) to balance plasticity and stability.
  arXiv  Detail & Related papers  (2026-02-08T09:53:46Z)
• Patching LLM Like Software: A Lightweight Method for Improving Safety Policy in Large Language Models [63.54707418559388]
  We propose patching for large language models (LLMs) like software versions.<n>Our method enables rapid remediation by prepending a compact, learnable prefix to an existing model.
  arXiv  Detail & Related papers  (2025-11-11T17:25:44Z)
• Match & Mend: Minimally Invasive Local Reassembly for Patching N-day Vulnerabilities in ARM Binaries [5.645823801022895]
  Low-cost Internet of Things (IoT) devices are increasingly popular but often insecure due to poor update regimes.<n>We propose to patch IoT firmware at the binary level, without requiring vendor support.<n>In particular, we introduce minimally invasive local reassembly, a new technique for automatically patching known (n-day) vulnerabilities in IoT firmware.
  arXiv  Detail & Related papers  (2025-10-16T07:31:42Z)
• Pixel-Optimization-Free Patch Attack on Stereo Depth Estimation [37.97727884936262]
  We build a unified framework that extends pixel-optimization attacks to four stereo-matching stages.<n>We propose PatchHunter, the first pixel-optimization-free attack.<n>On KITTI, PatchHunter outperforms pixel-level attacks in both effectiveness and black-box transferability.
  arXiv  Detail & Related papers  (2025-06-21T08:23:02Z)
• T2VShield: Model-Agnostic Jailbreak Defense for Text-to-Video Models [88.63040835652902]
  Text to video models are vulnerable to jailbreak attacks, where specially crafted prompts bypass safety mechanisms and lead to the generation of harmful or unsafe content.<n>We propose T2VShield, a comprehensive and model agnostic defense framework designed to protect text to video models from jailbreak threats.<n>Our method systematically analyzes the input, model, and output stages to identify the limitations of existing defenses.
  arXiv  Detail & Related papers  (2025-04-22T01:18:42Z)
• Centaur: Robust End-to-End Autonomous Driving with Test-Time Training [84.78837437133234]
  We propose Centaur, which updates a planner's behavior via test-time training without relying on hand-engineered rules or cost functions.<n>We develop a novel uncertainty measure, called Cluster Entropy, which is simple, interpretable, and compatible with state-of-the-art planning algorithms.
  arXiv  Detail & Related papers  (2025-03-14T17:59:41Z)
• Enhancing AUTOSAR-Based Firmware Over-the-Air Updates in the Automotive Industry with a Practical Implementation on a Steering System [0.0]
  This project aims to design and implement an advanced FOTA system tailored for modern vehicles.<n>The system integrates the UDS 0x27 protocol for authentication and data integrity during the update process.<n>The functionality of the system is demonstrated through two applications: a blinking LED and a Lane Keeping Assist (LKA) system.
  arXiv  Detail & Related papers  (2025-03-06T23:54:40Z)
• APIKS: A Modular ROS2 Framework for Rapid Prototyping and Validation of Automated Driving Systems [0.0]
  APIKS is a modular framework based on ROS2 for testing and validation of autonomous vehicle software.<n>It offers a simplified, standards-based architecture designed specifically for small-scale proofs of concept.
  arXiv  Detail & Related papers  (2025-02-27T20:29:31Z)
• AutoPatch: Automated Generation of Hotpatches for Real-Time Embedded Devices [8.026313049094147]
  Real-time embedded devices like medical or industrial devices are increasingly targeted by cyber-attacks. Hotpatching is an approach to apply a patch to mission-critical embedded devices without rebooting them. We propose AutoPatch, a new hotpatching technique that automatically generates equivalent hotpatches via static analysis of the official patches.
  arXiv  Detail & Related papers  (2024-08-27T19:11:39Z)
• Token-based Vehicular Security System (TVSS): Scalable, Secure, Low-latency Public Key Infrastructure for Connected Vehicles [1.062554955743753]
  We present TVSS, a new VPKI system which improves drastically over prior work in the area. TVSS leverages the idea of unforgeable tokens to enable rapid verification at the road side units (RSUs), which are part of the road infrastructure at the edge of the network. Notably, we are able to execute the bottleneck operation of our scheme with a stationary RSU while traveling at highway speeds.
  arXiv  Detail & Related papers  (2024-02-28T14:35:52Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.