Code execution in Tesla Model 3



Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2022-3093
CWE-ID CWE-367
Exploitation vector Local
Public exploit N/A
Vulnerable software
 Tesla Model 3
Other software / Other software solutions

Vendor Tesla

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Time-of-check Time-of-use (TOCTOU) Race Condition

EUVDB-ID: #VU67436

Risk: Low

CVSSv4.0: 4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-3093

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

Exploit availability: No

Description

The vulnerability allows a local attacker to execute arbitrary code on the system.

The vulnerability exists due to improper validation of user-supplied firmware within the ice_updater update mechanism. An attacker with physical access can execute arbitrary code on the target Tesla vehicles.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Tesla Model 3: before 2022.16.0.3

CPE2.3 External links

https://www.zerodayinitiative.com/advisories/ZDI-22-1188/


Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###