Vulnerability-Lookup

CNVD-2017-18628

Vulnerability from cnvd - Published: 2017-08-03

Title

Continental TCU堆栈缓冲区溢出漏洞

Description

TCU 是Continental AG（大陆集团）生产的现代汽车常用的，用于传输数据的2G调制解调器，可以实现汽车与远程管理工具（如 Web 面板和移动应用程序）之间的通信。 Continental TCU存在堆栈缓冲区溢出漏洞，影响使用 S-Gold 2（PMB 8876）蜂窝基带芯片的TCU，攻击者可利用AT指令访问易受攻击的车辆系统，并在 TCU 基带无线电处理器上执行任意代码。

Severity

高

Formal description

厂商尚未提供漏洞修补方案，请关注厂商主页及时更新： https://www.continental-corporation.com/zh-cn

Reference

http://securityaffairs.co/wordpress/61587/hacking/tcus-car-hacking.html https://media.defcon.org/DEF%20CON%2025/DEF%20CON%2025%20presentations/DEFCON-25-Jesse-Michael-and-Mickey-Shkatov-Driving-Down-the-Rabbit-Hole.pdf https://nvd.nist.gov/vuln/detail/CVE-2017-9647 https://ics-cert.us-cert.gov/advisories/ICSA-17-208-01

Impacted products

Name
['Nissan Nissan 2011-2015 Leaf', 'Infiniti Infiniti 2013 JX3', 'Infiniti Infiniti 2014-2016 QX60', 'Infiniti Infiniti 2014-2016 QX60 Hybrid', 'Infiniti Infiniti 2014-2015 QX50', 'Infiniti Infiniti 2014-2015 QX50 Hybrid', 'Infiniti Infiniti 2013 M37/M56', 'Infiniti Infiniti 2014-2016 Q70', 'Infiniti Infiniti 2014-2016 Q70L', 'Infiniti Infiniti 2015-2016 Q70 Hybrid', 'Infiniti Infiniti 2013 QX56', 'Infiniti Infiniti 2014-2016 QX 80', 'BMW BMW produced between 2009-2010', 'Ford P-HEV']

Name

['Nissan Nissan 2011-2015 Leaf', 'Infiniti Infiniti 2013 JX3', 'Infiniti Infiniti 2014-2016 QX60', 'Infiniti Infiniti 2014-2016 QX60 Hybrid', 'Infiniti Infiniti 2014-2015 QX50', 'Infiniti Infiniti 2014-2015 QX50 Hybrid', 'Infiniti Infiniti 2013 M37/M56', 'Infiniti Infiniti 2014-2016 Q70', 'Infiniti Infiniti 2014-2016 Q70L', 'Infiniti Infiniti 2015-2016 Q70 Hybrid', 'Infiniti Infiniti 2013 QX56', 'Infiniti Infiniti 2014-2016 QX 80', 'BMW BMW produced between 2009-2010', 'Ford P-HEV']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-9647"
    }
  },
  "description": "TCU \u662fContinental AG\uff08\u5927\u9646\u96c6\u56e2\uff09\u751f\u4ea7\u7684\u73b0\u4ee3\u6c7d\u8f66\u5e38\u7528\u7684\uff0c\u7528\u4e8e\u4f20\u8f93\u6570\u636e\u76842G\u8c03\u5236\u89e3\u8c03\u5668\uff0c\u53ef\u4ee5\u5b9e\u73b0\u6c7d\u8f66\u4e0e\u8fdc\u7a0b\u7ba1\u7406\u5de5\u5177\uff08\u5982 Web \u9762\u677f\u548c\u79fb\u52a8\u5e94\u7528\u7a0b\u5e8f\uff09\u4e4b\u95f4\u7684\u901a\u4fe1\u3002\r\n\r\nContinental TCU\u5b58\u5728\u5806\u6808\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u5f71\u54cd\u4f7f\u7528 S-Gold 2\uff08PMB 8876\uff09\u8702\u7a9d\u57fa\u5e26\u82af\u7247\u7684TCU\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528AT\u6307\u4ee4\u8bbf\u95ee\u6613\u53d7\u653b\u51fb\u7684\u8f66\u8f86\u7cfb\u7edf\uff0c\u5e76\u5728 TCU \u57fa\u5e26\u65e0\u7ebf\u7535\u5904\u7406\u5668\u4e0a\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002",
  "discovererName": "Mickey Shkatov, Jesse Michael, and Oleksandr Bazhaniuk (@jessemichael, @HackingThings, @ABazhaniuk) from the Advanced Threat Research Team at McAfee",
  "formalWay": "\u5382\u5546\u5c1a\u672a\u63d0\u4f9b\u6f0f\u6d1e\u4fee\u8865\u65b9\u6848\uff0c\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u53ca\u65f6\u66f4\u65b0\uff1a\r\nhttps://www.continental-corporation.com/zh-cn",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-18628",
  "openTime": "2017-08-03",
  "products": {
    "product": [
      "Nissan Nissan 2011-2015 Leaf",
      "Infiniti Infiniti 2013 JX3",
      "Infiniti Infiniti 2014-2016 QX60",
      "Infiniti Infiniti 2014-2016 QX60 Hybrid",
      "Infiniti Infiniti 2014-2015 QX50",
      "Infiniti Infiniti 2014-2015 QX50 Hybrid",
      "Infiniti Infiniti 2013 M37/M56",
      "Infiniti Infiniti 2014-2016 Q70",
      "Infiniti Infiniti 2014-2016 Q70L",
      "Infiniti Infiniti 2015-2016 Q70 Hybrid",
      "Infiniti Infiniti 2013 QX56",
      "Infiniti Infiniti 2014-2016 QX 80",
      "BMW BMW produced between 2009-2010",
      "Ford P-HEV"
    ]
  },
  "referenceLink": "http://securityaffairs.co/wordpress/61587/hacking/tcus-car-hacking.html\r\nhttps://media.defcon.org/DEF%20CON%2025/DEF%20CON%2025%20presentations/DEFCON-25-Jesse-Michael-and-Mickey-Shkatov-Driving-Down-the-Rabbit-Hole.pdf\r\nhttps://nvd.nist.gov/vuln/detail/CVE-2017-9647\r\nhttps://ics-cert.us-cert.gov/advisories/ICSA-17-208-01",
  "serverity": "\u9ad8",
  "submitTime": "2017-08-03",
  "title": "Continental TCU\u5806\u6808\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e"
}

CVE-2017-9647 (GCVE-0-2017-9647)

Vulnerability from cvelistv5 – Published: 2017-08-07 08:00 – Updated: 2024-08-05 17:18

Summary

A Stack-Based Buffer Overflow issue was discovered in the Continental AG Infineon S-Gold 2 (PMB 8876) chipset on BMW several models produced between 2009-2010, Ford a limited number of P-HEV vehicles, Infiniti 2013 JX35, Infiniti 2014-2016 QX60, Infiniti 2014-2016 QX60 Hybrid, Infiniti 2014-2015 QX50, Infiniti 2014-2015 QX50 Hybrid, Infiniti 2013 M37/M56, Infiniti 2014-2016 Q70, Infiniti 2014-2016 Q70L, Infiniti 2015-2016 Q70 Hybrid, Infiniti 2013 QX56, Infiniti 2014-2016 QX 80, and Nissan 2011-2015 Leaf. An attacker with a physical connection to the TCU may exploit a buffer overflow condition that exists in the processing of AT commands. This may allow arbitrary code execution on the baseband radio processor of the TCU.

Severity

No CVSS data available.

CWE

CWE-121

Assigner

icscert icscert root

References

2 references

URL	Tags
http://www.securityfocus.com/bid/100132	vdb-entryx_refsource_BID
https://ics-cert.us-cert.gov/advisories/ICSA-17-208-01	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
n/a	Continental AG Infineon S-Gold 2 (PMB 8876)	Affected: Continental AG Infineon S-Gold 2 (PMB 8876)

Date Public

2017-08-07 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T17:18:00.361Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "100132",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/100132"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-208-01"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Continental AG Infineon S-Gold 2 (PMB 8876)",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Continental AG Infineon S-Gold 2 (PMB 8876)"
            }
          ]
        }
      ],
      "datePublic": "2017-08-07T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A Stack-Based Buffer Overflow issue was discovered in the Continental AG Infineon S-Gold 2 (PMB 8876) chipset on BMW several models produced between 2009-2010, Ford a limited number of P-HEV vehicles, Infiniti 2013 JX35, Infiniti 2014-2016 QX60, Infiniti 2014-2016 QX60 Hybrid, Infiniti 2014-2015 QX50, Infiniti 2014-2015 QX50 Hybrid, Infiniti 2013 M37/M56, Infiniti 2014-2016 Q70, Infiniti 2014-2016 Q70L, Infiniti 2015-2016 Q70 Hybrid, Infiniti 2013 QX56, Infiniti 2014-2016 QX 80, and Nissan 2011-2015 Leaf. An attacker with a physical connection to the TCU may exploit a buffer overflow condition that exists in the processing of AT commands. This may allow arbitrary code execution on the baseband radio processor of the TCU."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-07T09:57:02.000Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "name": "100132",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/100132"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-208-01"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "ID": "CVE-2017-9647",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Continental AG Infineon S-Gold 2 (PMB 8876)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Continental AG Infineon S-Gold 2 (PMB 8876)"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A Stack-Based Buffer Overflow issue was discovered in the Continental AG Infineon S-Gold 2 (PMB 8876) chipset on BMW several models produced between 2009-2010, Ford a limited number of P-HEV vehicles, Infiniti 2013 JX35, Infiniti 2014-2016 QX60, Infiniti 2014-2016 QX60 Hybrid, Infiniti 2014-2015 QX50, Infiniti 2014-2015 QX50 Hybrid, Infiniti 2013 M37/M56, Infiniti 2014-2016 Q70, Infiniti 2014-2016 Q70L, Infiniti 2015-2016 Q70 Hybrid, Infiniti 2013 QX56, Infiniti 2014-2016 QX 80, and Nissan 2011-2015 Leaf. An attacker with a physical connection to the TCU may exploit a buffer overflow condition that exists in the processing of AT commands. This may allow arbitrary code execution on the baseband radio processor of the TCU."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-121"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "100132",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/100132"
            },
            {
              "name": "https://ics-cert.us-cert.gov/advisories/ICSA-17-208-01",
              "refsource": "MISC",
              "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-208-01"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2017-9647",
    "datePublished": "2017-08-07T08:00:00.000Z",
    "dateReserved": "2017-06-14T00:00:00.000Z",
    "dateUpdated": "2024-08-05T17:18:00.361Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CNVD-2017-18628

CVE-2017-9647 (GCVE-0-2017-9647)

Tags

Sightings

Nomenclature

Related by attack behaviour