Through the Window: On the exploitability of Xtensa's Register Window Overflow

While the name Xtensa is still mostly unknown to the public, the architecture plays a big role in the field of Internet of Things (IoT), be it in the form of custom designs or broadly used microcontrollers such as the ESP32 used inside millions of devices. This paper describes a newly discovered vulnerability that uses the window overflow exception handlers of an Xtensa LX processor to leak and manipulate data. To show its severity, an exploit is demonstrated that allows to disable Stack Canaries, a common protection against stack buffer overflows. Requirements and potential possibilities to escalate the vulnerability, including code-reuse attacks to completely compromise the attacked device. Finally, a countermeasure is introduced with a <0.5% runtime overhead in our worst-case scenario.