Two critical vulnerabilities have been found in Android Automotive OS. Manufacturers that use Android Automotive OS include Audi, Cadillac, Chevrolet, Chrysler, Dodge, Ford, GMC, Honda, Lincoln, Lucid, Maserati, Polestar, Renault (Europe only) Rivian, and Volvo.
These critical vulnerabilities are:
CVE-2023-33071: Improper Access Control; Memory corruption in Automotive OS whenever untrusted apps try to access HAb for graphics functionalities.
When untrusted apps attempt to access a specific area responsible for handling graphic functions, there's a problem with the system's memory. This issue leads to memory corruption, causing errors or unexpected behavior whenever these untrusted apps try to use graphical features.
CVE-2023-33070: Improper Authentication; Transient DOS in Automotive OS due to improper authentication to the secure IO calls
A Transient Denial of Service (DOS) issue occurs because there's a problem with how the system verifies and confirms the secure Input/Output (IO) requests. This means that sometimes, the system isn't properly checking or confirming the requests for communication between different parts of the car's system. As a result, this glitch or issue can temporarily disrupt or block certain functions in the car's operating system.
