Towards automated live-patching of AUTOSAR Adaptive applications

The automotive industry as a whole has been moving towards a software-defined vehicle (SDV) approach, thus increasing its reliance on software. Vulnerabilities in such, in-vehicle software have the possibility of being exploited via attackers that can have life-threatening consequences. To remediate these vulnerabilities, software patches are considered. However, with the traditional approaches, one has to physically visit a garage and an additional system downtime is required. Even, if we talk about Over The Air (OTA), not all systems have the capability to accommodate it. Moreover, traditional approaches are not feasible in scenarios with critical vulnerabilities which need to be fixed quickly. The solution to this problem is live-patching in vehicle (applying patchesduring system runtime). However, there are multiple challenges associated with this, when vehicles are on the road viz. criticality of systems, limited time for patch application, limited bandwidth and disk space for patch transfer and storage respectively. In order to solve the challenges related to system criticality, containerization technology is brought in. Live-patches can additionally address the issue of limitation of time, bandwidth and disk space. Live-patches are generally lightweight and comparatively faster than traditional patches. However, live-patching has certain shortcomings like involvement of several manual steps and human interactions to generate a live-patch. Another shortcoming is that a live-patch is applied in the volatile memory (RAM) and hence becomesineffective on system restart. In this paper, we propose an end to end methodology that addresses these exact challenges. We propose an approach to automate live-patching, by leveraging automatic live-patch generation techniques and on-board live-patch application. We implemented a small Proof of Concept in the form of a demonstrator, that handles a stack buffer overflow in an AUTOSAR adaptive application. A live-patch is generated in an automated way for the vulnerability and applied to the target application. All in all, we discuss the challenges associated with software patching in the automotive industry, particularly in the AUTOSAR Adaptive platform and provide an approach to tackle these challenges.