Good Motive but Bad Design: Pitfalls in MPU Usage in Embedded Systems in the Wild
summary
Comprehensive audit of popular microcontroller RTOS finds MPU support rare and defaults minimal: only a few OS enable DEP and stack guard, and many leave MPU programmable APIs reachable from unprivileged code. Concrete exploits show MPU disabled via control-flow hijack by calling kernel MPU disable helpers and a FreeRTOS privilege escalation path that flips saved privilege bits on the stack or creates a privileged task via wrapped syscall. Paper includes UART overflow demos, counts region limits (8 or 16), measures context switch/MPU reprogramming overhead, and proposes concrete mitigations like allocating high-number regions for kernel, using per-API syscalls, and exploiting subregions or TrustZone.
AI-written summary · about
chapters (10)
- 0:00Introduction and agenda
- 1:00MPU background and concepts
- 4:05Current MPU adoption status
- 5:29Exploiting MPU vulnerabilities
- 9:08Privilege escalation risks
- 12:58Exploitation steps and demos
- 17:00API vulnerabilities and risks
- 22:33Systemic MPU pitfalls
- 25:31Mitigation and best practices
- 31:02Summary and conclusions
related talks
25mKill Latest MPU-based Protections in Just One Shot: Targeting All Commodity RTOSes
41mIs Your Memory Protected? Uncovering Vul In Automotive MPU 
16mUsing PMP, ePMP and Rust to Protect Embedded Kernels, Even from Themselves
21mSoK: Where’s the “up”?! A Comprehensive (bottom-up) Study on the Security of...
35mZephyr OS Memory Protection
17mEnhancing OP-TEE for RISC-V: Leveraging IOPMP and Enabling RTOS Integration- 35mZephyr OS Memory Protection
33mAI Accelerated Exploiting: Compromising MTE Enabled Pixel from DSP Coprocessor