Is Your Memory Protected? Uncovering Vul In Automotive MPU
summary
Two hardware bugs in 32-bit PowerPC automotive MCUs let a privileged attacker flip the S‑MPU global valid bit and bypass region locks; tested on an SPC58 board and an MPC5748 with a PC, JTAG debugger and CAN connection, the exploit reliably disable GVLD bit and yields read/write/execute access (ST chips: read/write, NXP chips: read/write/execute). Vendors acknowledge documentation issues; ST calls S‑MPU nonsecurity. Mitigations: verify datasheet claims, prefer CMUs where present, use stack canaries and isolate HSM-protected secrets.
AI-written summary · about
chapters (7)
- 0:00Introduction to MPUs
- 1:07MPUs in automotive security
- 8:22Types of MPUs explained
- 12:40Vulnerabilities in MPU implementations
- 27:41Disclosure and vendor responses
- 31:57Mitigations and concluding remarks
- 33:21Q&A session
related talks
32mGood Motive but Bad Design: Pitfalls in MPU Usage in Embedded Systems in the Wild
25mKill Latest MPU-based Protections in Just One Shot: Targeting All Commodity RTOSes
52mSecuring The Unseen: Vulnerability Research In Confidential Computing
33mAI Accelerated Exploiting: Compromising MTE Enabled Pixel from DSP Coprocessor
35mZephyr OS Memory Protection
29mBackdooring of Real Time Automotive OS Devices
01h 07mPEW PEW PEW: Designing Secure Boot Securely
57mFinding, Managing, Preventing Vulnerabilities: An Automotive Perspective