Match & Mend: Minimally Invasive Local Reassembly for Patching N-day Vulnerabilities in ARM Binaries

TL;DR

IoT devices frequently run outdated ARM32 firmware with known vulnerabilities due to irregular vendor updates. The authors present Match & Mend, a binary-level, minimally invasive patching approach that uses CFG/DFG-guided analysis, three-phase patching (Analysis, Matching, Local Reassembly), and precise block-level patching to fix n-day vulnerabilities without altering overall functionality. The prototype patches real-world vulnerabilities (MAGMA) and real firmware (Karonte), achieving high patch rates (83% on MAGMA; 96% on Karonte) with modest patch sizes (5–46 KiB) and typical runtimes around 14 minutes per patch. This work demonstrates the practicality of static, locally targeted binary patches for extending the security and lifecycle of resource-constrained IoT devices, and points to future improvements in code similarity, automated backporting, and patch verification.

Abstract

Low-cost Internet of Things (IoT) devices are increasingly popular but often insecure due to poor update regimes. As a result, many devices run outdated and known-vulnerable versions of open-source software. We address this problem by proposing to patch IoT firmware at the binary level, without requiring vendor support. In particular, we introduce minimally invasive local reassembly, a new technique for automatically patching known (n-day) vulnerabilities in IoT firmware. Our approach is designed to minimize side effects and reduce the risk of introducing breaking changes. We systematically evaluate our approach both on 108 binaries within the controlled environment of the MAGMA benchmarks, as well as on 30 real-world Linux-based IoT firmware images from the KARONTE dataset. Our prototype successfully patches 83% of targeted vulnerabilities in MAGMA and 96% in the firmware dataset.

Figures (4)

• Figure 1: Schematic overview of the patching process, using the fictional example of a vulnerable , designed to concisely showcase the challenges and solutions of minimally invasive local reassembly. The vulnerability is patched in . 1 We identify vulnerable and patched functions in the binary and construct control and data flow graphs; 2 we match basic blocks between the functions using binary diffing and use this information to match references to code and data; 3 we transplant the code from the patched to the vulnerable version, adjusting all code and data references as needed and fixing up shifts from differences in addressing modes.
• Figure 2: Backward data flow slice computed from a memory access instruction. This slice captures the relevant definitions and uses needed to reconstruct equivalent data flow when reassembling the basic block in a different binary.
• Figure 3: Instructions and their intermediate representation in the backward slice computed in \ref{['fig:example']}.
• Figure 4: Histogram showing the size of each vulnerable library and the additional size of its patch.

Theorems & Definitions (7)

• Definition 1: Basic Block
• Definition 2: Definition and use of memory locations
• Definition 3: Control-Flow Graph
• Definition 4: Data Flow Graph (DFG)
• Definition 5: Reference
• Definition 6: Perfect Match of Basic Blocks
• Definition 7: Match of References