Tesla Model S oFono AT Command Heap-Based Buffer Overflow Code Execution Vulnerability

A heap-based buffer overflow vulnerability has been identified in the oFono component of Tesla Model S vehicles, allowing local attackers to execute arbitrary code. The vulnerability arises from improper validation of user-supplied data lengths in the parsing of AT command responses, leading to potential code execution in the device's context. To exploit this vulnerability, an attacker must first gain the ability to execute code on the target modem.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected vehicle.

Remediation

This vulnerability has been fixed in Tesla Firmware Version 2024.2.