Anchors that Don't Lift: Understanding Supply Chain Driven Kernel Lock-In and Governance-Mediated Mitigation Strategies in SOHO Devices

Small Office/Home Office (SOHO) devices are widely popular, yet often attacked due to security vulnerabilities in their firmware, affecting tens of thousands of devices at a time. These security vulnerabilities often stem from outdated Linux kernel versions included in SOHO device firmware. Naturally, prior work audited the extent and impact of this issue by simple Linux version extraction and version number based vulnerability mapping. However, it is unclear how many of these anticipated vulnerabilities actually exist in the heavily customized SOHO kernels and if there are any barriers towards updating Linux kernels in SOHO firmware.

To address this gap, we uncover actual kernel-related vulnerabilities in 900 firmwares of 306 SOHO devices (multiple versions per device) using a high-precision template-based CVE detection mechanism on GPL source releases. Next, as a first, we traced the supply chain of these vulnerable SOHO devices at scale and identify kernel lock-in as a significant security issue-SOHO vendors are effectively locked to specific (often older) kernel versions due to the system-on-chip (SoC) SDKs they use. This kernel lock-in produces a vulnerability debt that is inherited along the supply chain from SoC vendor to firmware creators (ODM/OEM) to router/IPcamera vendor and ultimately borne by end users. All five SoC vendors in our dataset have used SDKs with Linux kernels that had reached End of Life (EoL) more than a year before their usage in a SOHO device. Finally, we explore the mitigation potential of individual, regulatory and community governance by analyzing social media posts, regulations and community efforts. Our results show that regulation compliance is insufficient and only SoC vendors who engage with communities for kernel upgrades offered a viable path towards mitigation. We conclude by discussing broader implications of our work for improving holistic security of the supply chain for SOHO devices. The data and code for this work is available at