SoK: Where’s the “up”?! A Comprehensive (bottom-up) Study on the Security of...
summary
Comprehensive audit collects over 7,000 firmware samples and validates 1,797 real-world firmware, scans ~500 related CVEs, and releases tooling on GitHub; key findings show Cortex‑M lacks an MMU, vendors rarely use the MPU so memory isolation is weak, stack canaries are ineffective because all code shares one address space, and over half of disclosed bugs are high or critical in I/O and protocol code; paper includes exploit proof of concept for fast secure/nonsecure state switching and maps defenses to practical hardware limits.
AI-written summary · about
chapters (13)
- 0:00SoK on ARM Cortex-M security
- 1:11Focus on Cortex-M microcontrollers
- 2:13Research questions and methodology
- 4:21Firmware collection and validation
- 4:41Hardware limitations in Cortex-M
- 6:50Real-world firmware architectures
- 7:54Security features in firmware analysis
- 12:10Cortex-M CVEs analysis
- 14:19Security research taxonomy on Cortex-M
- 17:34Academic versus real-world gap
- 18:37Future research recommendations
- 20:23Key takeaways and resources
- 21:07Q&A
related talks
16mSoK: 20 Years of Power, Privilege, and Peril in x86 System Management Mode
51mFirmware Cartography: Charting the Course for Modern Server Compromise
20mSoK: Insecurity of Cellular Basebands
46mInsights from Zephyr Security Audit and Vulnerability Experiences
25mKill Latest MPU-based Protections in Just One Shot: Targeting All Commodity RTOSes
39mNight of the living vulnerabilities
40mHardware Security Is Hard: How Hardware Boundaries Define Platform Security
53mBack To The Future With Platform Security