Search papers, labs, and topics across Lattice.
This study investigates the security vulnerabilities in Small Office/Home Office (SOHO) devices, revealing that outdated Linux kernels contribute significantly to these issues. By employing a high-precision template-based CVE detection mechanism, the authors identified actual kernel-related vulnerabilities in 306 SOHO devices and traced the supply chain to uncover kernel lock-in as a critical security concern. The findings indicate that all five SoC vendors analyzed utilized SDKs with end-of-life kernels, highlighting the need for community engagement and regulatory compliance to effectively mitigate these vulnerabilities.
Kernel lock-in traps SOHO devices in a cycle of outdated security, leaving users exposed to significant vulnerabilities inherited from the supply chain.
Small Office/Home Office (SOHO) devices are widely popular, yet often attacked due to security vulnerabilities in their firmware, affecting thousands of devices. These security vulnerabilities often stem from outdated Linux kernel versions included in SOHO device firmware. Naturally, prior work audited the extent and impact of this issue by simple Linux version extraction and version number based vulnerability mapping. However, it is unclear how many of these anticipated vulnerabilities actually exist in the heavily customized SOHO kernels and if there are any barriers towards updating Linux kernels in SOHO firmwares. To address this gap, we uncover actual kernel-related vulnerabilities found in 306 SOHO devices using a high-precision template-based CVE detection mechanism on GPL source releases of more than 900 firmwares from these devices. Next, as a first, we traced the supply chain of these vulnerable SOHO devices at scale and identify kernel lock-in as a significant security issue -- SOHO vendors are effectively locked to specific (often older) kernel versions due to the system-on-chip (SoC) SDKs they use. This kernel lock-in produces a vulnerability debt that is inherited along the supply chain from SoC vendor to firmware creators (ODM/OEM) to router/IP-camera vendor and ultimately borne by end users. All five SoC vendors in our dataset had used SDKs with Linux kernels that had reached EoL more than a year before their usage in a SOHO device. Finally, we explore the mitigation-potential of individual, regulatory and community governance by analyzing social media posts, regulations and community efforts. Our results show that regulation compliance is insufficient and only SoC vendors who engage with communities for kernel upgradation offered a viable path towards mitigation. The data and code for this work is available at https://doi.org/10.5281/zenodo.20433799
