CVE-2022-3093: (Pwn2Own) Tesla ice_updater Time-Of-Check Time-Of-Use Code Execution Vulnerability
This vulnerability allows physical attackers to execute arbitrary code on affected Tesla vehicles. Authentication is not required to exploit this vulnerability. The specific flaw exists within the iceupdater update mechanism. The issue results from the lack of proper validation of user-supplied firmware. An attacker can leverage this vulnerability to execute code in the context of root.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-3093?
CVE-2022-3093 is a vulnerability that allows physical attackers to execute arbitrary code on affected Tesla vehicles.
How can the CVE-2022-3093 vulnerability be exploited?
The CVE-2022-3093 vulnerability can be exploited by physical attackers without requiring authentication.
Which Tesla vehicles are affected by CVE-2022-3093?
Tesla Model 3, Tesla Model S, and Tesla Model X vehicles with firmware versions up to and exclusive of 2022.16.0.3 are affected.
What is the severity of CVE-2022-3093?
CVE-2022-3093 has a severity rating of 7.6 (high).
Is Tesla Model 3 vulnerable to CVE-2022-3093?
Yes, Tesla Model 3 vehicles with firmware versions up to and exclusive of 2022.16.0.3 are vulnerable to CVE-2022-3093.
How can I fix the CVE-2022-3093 vulnerability?
It is recommended to update the firmware of affected Tesla vehicles to a version higher than 2022.16.0.3 to mitigate the CVE-2022-3093 vulnerability.