CVE-2017-14937

{"id": "CVE-2017-14937", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 1.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 4.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.0}]}, "published": "2017-10-20T14:29:00.193", "references": [{"url": "http://www.mmt.hs-karlsruhe.de/downloads/IEEM/Schwachstellen/PCU_Vulnerability_Description_HsKA.PDF", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.rapid7.com/db/modules/post/hardware/automotive/pdt", "source": "cve@mitre.org"}, {"url": "https://www.researchgate.net/publication/321183727_Security_Evaluation_of_an_Airbag-ECU_by_Reusing_Threat_Modeling_Artefacts", "source": "cve@mitre.org"}, {"url": "http://www.mmt.hs-karlsruhe.de/downloads/IEEM/Schwachstellen/PCU_Vulnerability_Description_HsKA.PDF", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.rapid7.com/db/modules/post/hardware/automotive/pdt", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.researchgate.net/publication/321183727_Security_Evaluation_of_an_Airbag-ECU_by_Reusing_Threat_Modeling_Artefacts", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-327"}]}], "descriptions": [{"lang": "en", "value": "The airbag detonation algorithm allows injury to passenger-car occupants via predictable Security Access (SA) data to the internal CAN bus (or the OBD connector). This affects the airbag control units (aka pyrotechnical control units or PCUs) of unspecified passenger vehicles manufactured in 2014 or later, when the ignition is on and the speed is less than 6 km/h. Specifically, there are only 256 possible key pairs, and authentication attempts have no rate limit. In addition, at least one manufacturer's interpretation of the ISO 26021 standard is that it must be possible to calculate the key directly (i.e., the other 255 key pairs must not be used). Exploitation would typically involve an attacker who has already gained access to the CAN bus, and sends a crafted Unified Diagnostic Service (UDS) message to detonate the pyrotechnical charges, resulting in the same passenger-injury risks as in any airbag deployment."}, {"lang": "es", "value": "El algoritmo de detonaci\u00f3n del airbag permite que los ocupantes de un turismo sufran heridas mediante datos Security Access (SA) predecibles en el bus CAN (o el conector OBD). Esto afecta a las unidades de control de airbag (tambi\u00e9n llamadas unidades de control de elementos pirot\u00e9cnicos o PCU) de veh\u00edculos de pasajeros sin especificar fabricados en 2014 o posteriores, cuando la ignici\u00f3n est\u00e1 encendida y la velocidad es inferior a 6 km/h. Espec\u00edficamente, solo hay 256 pares de claves posibles, mientras que los intentos de autenticaci\u00f3n no tienen l\u00edmite de tasa. Adem\u00e1s, la interpretaci\u00f3n de al menos un fabricante del est\u00e1ndar ISO 26021 es que debe ser posible calcular la clave directamente (esto es, los otros 255 pares de claves no deben ser utilizados). Su explotaci\u00f3n implicar\u00eda a un atacante que ha obtenido acceso al bus CAN y que env\u00eda un mensaje Unified Diagnostic Service (USD) manipulado para detonar las cargas pirot\u00e9cnicas. Esto resulta en el mismo riesgo de heridas para el pasajero como en cualquier implementaci\u00f3n de airbag."}], "lastModified": "2024-11-21T03:13:47.913", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:pcu:pcu:2014:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1BF912B0-66E7-4377-876E-368E191F109B"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}