CVE-2023-32155: (Pwn2Own) Tesla Model 3 bcmdhd Out-Of-Bounds Write Local Privilege Escalation Vulnerability
First published: Fri May 03 2024(Updated: )
Tesla Model 3 bcmdhd Out-Of-Bounds Write Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected Tesla Model 3 vehicles. An attacker must first obtain the ability to execute code on the wifi subsystem in order to exploit this vulnerability. The specific flaw exists within the bcmdhd driver. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel. . Was ZDI-CAN-20733.
Credit: zdi-disclosures@trendmicro.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Tesla Model 3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-32155?
CVE-2023-32155 is considered a high severity vulnerability due to its potential for local privilege escalation on affected Tesla Model 3 vehicles.
How do I fix CVE-2023-32155?
To mitigate CVE-2023-32155, Tesla owners should ensure their vehicle's software is updated to the latest version provided by Tesla.
Who is affected by CVE-2023-32155?
CVE-2023-32155 affects users of the Tesla Model 3 who have not updated their vehicle's software to address this specific vulnerability.
What kind of attacks can be executed through CVE-2023-32155?
CVE-2023-32155 allows local attackers with access to the wifi subsystem to escalate their privileges on the Tesla Model 3.
Is CVE-2023-32155 actively being exploited?
There is no public information indicating that CVE-2023-32155 is being actively exploited at this time, but it remains a significant security concern.
- agent/references
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/title
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-23-971
- alias/ZDI-CAN-20733
- alias/CVE-2023-32155
- agent/software-canonical-lookup
- agent/softwarecombine
- agent/author
- agent/severity
- agent/event
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/description
- agent/trending
- agent/tags
- agent/source
- vendor/tesla
- canonical/tesla model 3