Polina Smirnova

Name of the Vulnerable Software and Affected Versions: MIB3 infotainment unit (affected versions not specified) Description: A logic flaw in the bootloader component of the MIB3 infotainment unit leads to a RAM buffer overflow, allowing an attacker with physical access to the MIB3 ECU to bypass firmware signature verification and run arbitrary code in the infotainment system at boot process. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue concerns an improper isolation authentication bypass vulnerability in the Bluetooth functionality. It was discovered by Mikhail Evdokimov from PCAutomotive.

The issue is related to an integer overflow in the Bluetooth SDP protocol, which can lead to remote code execution. This was demonstrated at Pwn2Own.

The issue is related to a heap-based buffer overflow in the Bluetooth AVCTP protocol, which can lead to remote code execution. This was demonstrated at Pwn2Own.

The anti-theft protection mechanism can be bypassed due to weak response generation algorithms for the head unit. Attackers can reveal all 32 corresponding responses by sniffing CAN traffic or pre-calculating the values, allowing them to bypass the protection.

The issue is related to a buffer overflow in the client.c component of ConnMan's gdhcp, which can be exploited by network-adjacent attackers operating a crafted DHCP server. This can cause a stack-based buffer overflow, leading to a denial of service and terminating the connman process.