CVE-2023-28908: Integer Overflow in Non-Fragmented Data Reception
A specific flaw exists within the Bluetooth stack of the MIB3 infotainment. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow when receiving non-fragmented HCI packets on a channel. The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-28908?
CVE-2023-28908 is considered a critical vulnerability due to its potential to cause an integer overflow in the Bluetooth stack.
How do I fix CVE-2023-28908?
To fix CVE-2023-28908, ensure that the latest firmware updates are applied to the Skoda MIB3 infotainment system.
What systems are affected by CVE-2023-28908?
CVE-2023-28908 affects the Skoda MIB3 infotainment system that utilizes the Bluetooth stack.
What type of vulnerability is CVE-2023-28908?
CVE-2023-28908 is a validation and integer overflow vulnerability within the Bluetooth stack.
Can CVE-2023-28908 be exploited remotely?
Yes, CVE-2023-28908 can potentially be exploited remotely through crafted non-fragmented HCI packets.