CVE-2023-29113: A lack of access control in custom IPC mechanism
The MIB3 infotainment unit used in Skoda and Volkswagen vehicles does not incorporate any privilege separation for the proprietary inter-process communication mechanism, leaving attackers with presence in the system an ability to undermine access control restrictions implemented at the operating system level. The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-29113?
CVE-2023-29113 is classified as a high-severity vulnerability due to its potential to allow unauthorized access to vehicle systems.
How do I fix CVE-2023-29113?
To mitigate CVE-2023-29113, ensure that your Skoda or Volkswagen MIB3 infotainment unit firmware is updated to the latest version provided by the manufacturer.
What systems are impacted by CVE-2023-29113?
CVE-2023-29113 affects the MIB3 infotainment units in Skoda and Volkswagen vehicles.
What kind of attack can exploit CVE-2023-29113?
CVE-2023-29113 can be exploited by local attackers who gain access to the vehicle's system, allowing them to bypass access controls.
Is there a known exploit for CVE-2023-29113?
As of now, there are no publicly documented exploits specifically targeting CVE-2023-29113, but the vulnerability's nature poses significant risk.