TY - GEN A1 - Lehniger, Kai A1 - Langendörfer, Peter T1 - Through the Window: Exploitation and Countermeasures of the ESP32 Register Window Overflow T2 - Future Internet N2 - With the increasing popularity of IoT (Internet-of-Things) devices, their security becomes an increasingly important issue. Buffer overflow vulnerabilities have been known for decades, but are still relevant, especially for embedded devices where certain security measures cannot be implemented due to hardware restrictions or simply due to their impact on performance. Therefore, many buffer overflow detection mechanisms check for overflows only before critical data are used. All data that an attacker could use for his own purposes can be considered critical. It is, therefore, essential that all critical data are checked between writing a buffer and its usage. This paper presents a vulnerability of the ESP32 microcontroller, used in millions of IoT devices, that is based on a pointer that is not protected by classic buffer overflow detection mechanisms such as Stack Canaries or Shadow Stacks. This paper discusses the implications of vulnerability and presents mitigation techniques, including a patch, that fixes the vulnerability. The overhead of the patch is evaluated using simulation as well as an ESP32-WROVER-E development board. We showed that, in the simulation with 32 general-purpose registers, the overhead for the CoreMark benchmark ranges between 0.1% and 0.4%. On the ESP32, which uses an Xtensa LX6 core with 64 general-purpose registers, the overhead went down to below 0.01%. A worst-case scenario, modeled by a synthetic benchmark, showed overheads up to 9.68%. KW - Xtensa KW - Buffer overflow KW - return-oriented prgramming Y1 - 2023 U6 - https://doi.org/10.3390/fi15060217 SN - 1999-5903 VL - 15 IS - 6 ER - TY - GEN A1 - Lehniger, Kai A1 - Langendorfer, Peter T1 - Elevating parallel shadow stack concepts for architectures with register windows T2 - IEEE transactions on dependable and secure computing N2 - Register windows are a processor feature that was originally developed to reduce the frequency for register spilling. This paper investigates how this mechanism can be used to implement a parallel shadow stack to protect return addresses from being corrupted. Furthermore, multiple improvements based on properties directly following the usage of register windows are proposed. Different configurations of parallel shadow stacks are evaluated based on prototype implementations on an ESP32 microcontroller and tested with different benchmarks. Performance overheads below 0.01% for CoreMark, below 3% for the worst case in MbedsTLS, and a worst case scenario of 22.153% for a recursive function show that our concepts are able to be efficiently developed even for embedded devices like the ESP32. KW - Buffer overflow KW - Shadow stack KW - Return-oriented programming KW - Register windows KW - Xtensa KW - ESP32 Y1 - 2025 U6 - https://doi.org/10.1109/TDSC.2025.3604556 SN - 1545-5971 SN - 1941-0018 SP - 1 EP - 18 PB - Institute of Electrical and Electronics Engineers (IEEE) CY - Piscataway, NJ ER -