CVE-2018-18203

A vulnerability in the update mechanism of Subaru StarLink Harman head units 2017, 2018, and 2019 may give an attacker (with physical access to the vehicle's USB ports) the ability to rewrite the firmware of the head unit. This occurs because the device accepts modified QNX6 filesystem images (as long as the attacker obtains access to certain Harman decryption/encryption code) as a consequence of a bug where unsigned images pass a validity check. An attacker could potentially install persistent malicious head unit firmware and execute arbitrary code as the root user.

CVSS v3 6.4 MEDIUM
CVSS v2.0 6.9 MEDIUM

6.4^/10

CVSS v3 : MEDIUM

Vector : AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 0.5 / Impact : 5.9

Attack Vector PHYSICAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.9^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 3.4 / Impact : 10.0

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://github.com/sgayou/subaru_starlink_research	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:subaru:starlink_2017_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:subaru:starlink_2017:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:subaru:starlink_2018_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:subaru:starlink_2018:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:subaru:starlink_2019_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:subaru:starlink_2019:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-11-28 23:29

Updated : 2024-02-04 20:03

NVD link : CVE-2018-18203

Mitre link : CVE-2018-18203

CVE.ORG link : CVE-2018-18203

JSON object : View

Products Affected

subaru

starlink_2019
starlink_2018_firmware
starlink_2018
starlink_2017
starlink_2019_firmware
starlink_2017_firmware

CWE

CWE-347

Improper Verification of Cryptographic Signature

{"id": "CVE-2018-18203", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.4, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.5}]}, "published": "2018-11-28T23:29:00.357", "references": [{"url": "https://github.com/sgayou/subaru_starlink_research", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-347"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the update mechanism of Subaru StarLink Harman head units 2017, 2018, and 2019 may give an attacker (with physical access to the vehicle's USB ports) the ability to rewrite the firmware of the head unit. This occurs because the device accepts modified QNX6 filesystem images (as long as the attacker obtains access to certain Harman decryption/encryption code) as a consequence of a bug where unsigned images pass a validity check. An attacker could potentially install persistent malicious head unit firmware and execute arbitrary code as the root user."}, {"lang": "es", "value": "Una vulnerabilidad en el mecanismo de actualizaci\u00f3n de Subaru StarLink Harman, en las unidades principales 2017, 2018 y 2019, podr\u00eda otorgar a un atacante (con acceso f\u00edsico a los puertos USB del veh\u00edculo) la capacidad de reescribir el firmware de la unidad principal. Esto ocurre debido a que el dispositivo acepta im\u00e1genes modificadas del sistema de archivos QNX6 (siempre que el atacante obtenga acceso a cierto c\u00f3digo de descifrado/cifrado de Harman) como consecuencia de un error por el cual las im\u00e1genes no firmadas pasan una comprobaci\u00f3n de validez. Un atacante podr\u00eda instalar firmware de la unidad principal malicioso y persistente, as\u00ed como ejecutar c\u00f3digo arbitrario como usuario root."}], "lastModified": "2019-02-05T20:25:35.177", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:subaru:starlink_2017_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9F58AE13-21B3-4D68-BD6C-3DFB87C22EEC"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:subaru:starlink_2017:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "AE566456-6FDF-46F2-A134-CF10F5A651A2"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:subaru:starlink_2018_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5F4A934A-77D5-458B-AEDF-DEAE4141D132"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:subaru:starlink_2018:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2C4D4E5F-2C65-4B74-95B5-7CB56A497B1B"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:subaru:starlink_2019_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "84AE643D-BA28-4A9E-9F93-59016FC6D29B"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:subaru:starlink_2019:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "10055215-2FA2-44F3-AC50-71654CA25353"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}