CVE-2022-3093 - Vulnerability Details - OpenCVE

This vulnerability allows physical attackers to execute arbitrary code on affected Tesla vehicles. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ice_updater update mechanism. The issue results from the lack of proper validation of user-supplied firmware. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-17463.

No CVSS v4.0

Attack Vector Physical

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Attack Vector Physical

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Tesla	Model 3 Model 3 Firmware Model S Model S Firmware Model X Model X Firmware Model Y Model Y Firmware

Configuration 1 [-]

AND

cpe:2.3:o:tesla:model_3_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tesla:model_3:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:tesla:model_s_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tesla:model_s:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:tesla:model_x_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tesla:model_x:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:tesla:model_y_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tesla:model_y:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.zerodayinitiative.com/advisories/ZDI-22-1188/

History

Fri, 14 Feb 2025 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: zdi

Published: 2023-03-29T00:00:00.000Z

Updated: 2025-02-14T16:35:03.426Z

Reserved: 2022-09-01T00:00:00.000Z

Link: CVE-2022-3093

Vulnrichment

Updated: 2024-08-03T01:00:10.329Z

NVD

Status : Modified

Published: 2023-03-29T19:15:17.013

Modified: 2024-11-21T07:18:48.747

Link: CVE-2022-3093

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-3093", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "assignerShortName": "zdi", "dateUpdated": "2025-02-14T16:35:03.426Z", "dateReserved": "2022-09-01T00:00:00.000Z", "datePublished": "2023-03-29T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2023-03-29T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "This vulnerability allows physical attackers to execute arbitrary code on affected Tesla vehicles. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ice_updater update mechanism. The issue results from the lack of proper validation of user-supplied firmware. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-17463."}], "affected": [{"vendor": "Tesla", "product": "Model 3", "versions": [{"version": "Model 3", "status": "affected"}]}], "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-22-1188/"}], "credits": [{"lang": "en", "value": "@Jedar_LZ"}], "metrics": [{"cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attackVector": "PHYSICAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 7.6, "baseSeverity": "HIGH"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition", "cweId": "CWE-367"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T01:00:10.329Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-22-1188/", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-14T16:35:00.590308Z", "id": "CVE-2022-3093", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-14T16:35:03.426Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-22-1188/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T01:00:10.329Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-3093", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-02-14T16:35:00.590308Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-14T16:34:29.133Z"}}], "cna": {"credits": [{"lang": "en", "value": "@Jedar_LZ"}], "metrics": [{"cvssV3_0": {"scope": "CHANGED", "version": "3.0", "baseScore": 7.6, "attackVector": "PHYSICAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Tesla", "product": "Model 3", "versions": [{"status": "affected", "version": "Model 3"}]}], "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-22-1188/"}], "descriptions": [{"lang": "en", "value": "This vulnerability allows physical attackers to execute arbitrary code on affected Tesla vehicles. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ice_updater update mechanism. The issue results from the lack of proper validation of user-supplied firmware. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-17463."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-367", "description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition"}]}], "providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2023-03-29T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2022-3093", "state": "PUBLISHED", "dateUpdated": "2025-02-14T16:35:03.426Z", "dateReserved": "2022-09-01T00:00:00.000Z", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "datePublished": "2023-03-29T00:00:00.000Z", "assignerShortName": "zdi"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tesla:model_3_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "E571E233-D3B9-40B7-AFBC-C69682C3BFF9", "versionEndExcluding": "2022.16.0.3", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tesla:model_3:-:*:*:*:*:*:*:*", "matchCriteriaId": "825A79FD-C872-4564-9782-83BEEADDF5D9", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tesla:model_s_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "842FFD5D-5997-4AC9-8B97-CA9B5CEB5A25", "versionEndExcluding": "2022.16.0.3", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tesla:model_s:-:*:*:*:*:*:*:*", "matchCriteriaId": "8D28E699-B843-4641-9BA6-406D88231E7C", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tesla:model_x_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "253FD2FF-5849-4AD5-922E-157F4D75C527", "versionEndExcluding": "2022.16.0.3", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tesla:model_x:-:*:*:*:*:*:*:*", "matchCriteriaId": "C550FF8A-58ED-4265-B33F-10AFDEA95519", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tesla:model_y_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "D55D2752-744A-4B14-B7FB-E2BC958CE30E", "versionEndExcluding": "2022.16.0.3", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tesla:model_y:-:*:*:*:*:*:*:*", "matchCriteriaId": "43824EBF-924C-4A75-A7F9-F19B4304CF66", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "This vulnerability allows physical attackers to execute arbitrary code on affected Tesla vehicles. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ice_updater update mechanism. The issue results from the lack of proper validation of user-supplied firmware. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-17463."}], "id": "CVE-2022-3093", "lastModified": "2024-11-21T07:18:48.747", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 0.9, "impactScore": 6.0, "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.5, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-03-29T19:15:17.013", "references": [{"source": "zdi-disclosures@trendmicro.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-22-1188/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-22-1188/"}], "sourceIdentifier": "zdi-disclosures@trendmicro.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-367"}], "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}]}