ZDI-CAN-23200: (Pwn2Own) Tesla Model S oFono Unnecessary Privileges Sandbox Escape Vulnerability
This vulnerability allows local attackers to escape the sandbox on affected Tesla Model S vehicles. An attacker must first obtain the ability to execute code within the sandbox on the target system in order to exploit this vulnerability. The specific flaw exists within the oFono process. The process allows an attacker to modify interfaces. An attacker can leverage this vulnerability to bypass the iptables network sandbox.
Other sources
This vulnerability allows local attackers to escape the sandbox on affected Tesla Model S vehicles. An attacker must first obtain the ability to execute code within the sandbox on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.0. The following CVEs are assigned: CVE-2024-6030.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-23200?
The severity of ZDI-CAN-23200 is considered high due to its potential impact on vehicle security.
How do I fix ZDI-CAN-23200?
To fix ZDI-CAN-23200, Tesla recommends updating the firmware of the affected Model S vehicles to the latest version.
Who is affected by ZDI-CAN-23200?
ZDI-CAN-23200 affects Tesla Model S vehicles that are running vulnerable firmware.
What does ZDI-CAN-23200 allow an attacker to do?
ZDI-CAN-23200 allows local attackers to escape the sandbox environment on affected Tesla Model S vehicles.
What is required to exploit ZDI-CAN-23200?
An attacker must first have the ability to execute code within the sandbox on the target Tesla Model S to exploit ZDI-CAN-23200.