Vincent Dehors

Name of the Vulnerable Software and Affected Versions: Wyze Cam v3 versions (affected versions not specified) Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Wyze Cam v3 IP cameras without authentication. The flaw resides within the Realtek Wi-Fi kernel module, resulting from insufficient validation of user-supplied data length before copying it into a heap-based buffer. Successful exploitation enables an attacker to execute code in the context of the kernel. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

This issue allows network-adjacent attackers to execute arbitrary code on affected vehicles. The flaw exists within the handling of firmware updates, resulting from improper error-handling during the update process. An attacker can leverage this issue to execute code in the context of Tesla's Gateway ECU. The attacker must first obtain the ability to execute privileged code on the Tesla infotainment system.

This issue allows local attackers to escalate privileges on affected Tesla Model 3 vehicles. An attacker must first obtain the ability to execute code on the wifi subsystem in order to exploit this issue. The specific flaw exists within the bcmdhd driver, resulting from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this issue to escalate privileges and execute arbitrary code in the context of the kernel.

This issue allows network-adjacent attackers to execute arbitrary code on affected Tesla Model 3 vehicles. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this issue. The specific flaw exists within the bsa server process, resulting from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this issue to execute code in the context of an unprivileged user in a sandboxed process.

The issue is related to the Go runtime not behaving differently when a binary is run with the setuid/setgid bits on Unix platforms. This can be dangerous in certain cases, such as when dumping memory state or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers. Exploitation of this issue may allow a remote attacker to elevate their privileges and gain read, modify, or delete access to data.

This issue allows local attackers to escalate privileges on affected Tesla vehicles. An attacker must first obtain the ability to execute privileged code on the target system in order to exploit this issue. The specific flaw exists within the handling of the `wowlan config` data structure. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this issue to escalate privileges and execute arbitrary code in the context of root.

This issue allows local attackers to escalate privileges on affected Tesla vehicles. An attacker must first obtain the ability to execute privileged code on the target system in order to exploit this issue. The specific flaw exists within the `bcmdhd` driver. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a buffer. An attacker can leverage this issue to escalate privileges and execute arbitrary code in the context of root.

The issue is related to the `copy from user()` function in the shiftfs file system of the Linux kernel, which is associated with a double-free memory error. This can allow an attacker to access confidential data, compromise data integrity, and cause a denial of service. The vulnerability can also be exploited to gain privileges via executing arbitrary code. An attacker could use this to cause kernel memory exhaustion.