Volkswagen MIB3 Infotainment Lack of Memory Isolation Vulnerability

A vulnerability exists in the Volkswagen MIB3 infotainment system, specifically in units manufactured by Preh Car Connect GmbH, including the Skoda Superb III model. The issue arises from the absence of memory isolation between CPU cores, allowing an attacker with access to the main operating system to interfere with the CPU core that processes CAN messages. This vulnerability could lead to unauthorized manipulation of vehicle functions via the CAN bus.

Impact

Exploitation of this vulnerability could result in unauthorized access to the CARCOM CPU core, which manages CAN bus communications. This would allow an attacker to read and write CAN messages, potentially interfering with vehicle functions, although safety-critical CAN channels are typically protected by filters.