Abstract:Open-source kernels have been adopted by massive downstream vendors on billions of devices. However, these vendors often omit or delay the adoption of patches released in the mainstream version. Even worse, many vendors are not publicizing the patching progress or even disclosing misleading information. However, patching status is critical for groups (e.g., governments and enterprise users) that are keen to security threats. Such a practice motivates the need for reliable patch presence testing for downstream kernels. Currently, the best means of patch presence testing is to examine the existence of a patch in the target kernel by using the code signature match. However, such an approach cannot address the key challenges in practice. Specifically, downstream vendors widely customize the mainstream code and use non-standard building configurations, which often change the code around the patching sites such that the code signatures are ineffective. In this work, we propose PDIFF, a system to perform highly reliable patch presence testing with downstream kernel images. Technically speaking, PDIFF generates summaries carrying the semantics related to a target patch. Based on the semantic summaries, PDIFF compares the target kernel with its mainstream version before and after the adoption of the patch, preferring the closer reference version to determine the patching status. Unlike previous research on patch presence testing, our approach examines similarity based on the semantics of patches and therefore, provides high tolerance to code-level variations. Our test with 398 kernel images corresponding to 51 patches shows that PDIFF can achieve high accuracy with an extremely low rate of false negatives and zero false positives. This significantly outperforms the state-of-theart tool. More importantly, PDIFF demonstrates consistently high effectiveness when code customization and non-standard building configurations occur.

RapidPatch: Firmware Hotpatching for Real-Time Embedded Devices

AutoPatch: Automated Generation of Hotpatches for Real-Time Embedded Devices

ICSPatch: Automated Vulnerability Localization and Non-Intrusive Hotpatching in Industrial Control Systems using Data Dependence Graphs

Firmware Re-hosting Through Static Binary-level Porting

REACT: IR-Level Patch Presence Test for Binary

When a Patch is Not Enough - HardFails: Software-Exploitable Hardware Bugs

AutoPaG: towards automated software patch generation with source code root cause identification and repair

Adaptive Android Kernel Live Patching.

FPGA-Patch: Mitigating Remote Side-Channel Attacks on FPGAs using Dynamic Patch Generation

Toward Hardware-Based IP Vulnerability Detection and Post-Deployment Patching in Systems-on-Chip

Sound Patch Generation for Vulnerabilities

Backporting Security Patches of Web Applications: A Prototype Design and Implementation on Injection Vulnerability Patches

PDIFF: Semantic-based Patch Presence Testing for Downstream Kernels

VCIPR: Vulnerable Code is Identifiable When a Patch is Released (Hacker's Perspective)

HRPDF: A Software-Based Heterogeneous Redundant Proactive Defense Framework for Programmable Logic Controller.

HARM: Hardware-Assisted Continuous Re-randomization for Microcontrollers

Traffic-aware Patching for Cyber Security in Mobile IoT

AutoPatchDroid: A Framework for Patching Inter-App Vulnerabilities in Android Application

Physical Devices-Agnostic Hybrid Fuzzing of IoT Firmware

EVMPatch: Timely and Automated Patching of Ethereum Smart Contracts