Tesla Model 3 VCSEC Integer Overflow Remote Code Execution Vulnerability

An integer overflow vulnerability allowing remote code execution has been identified in the VCSEC module of Tesla Model 3 vehicles. This issue arises from manipulating the certificate response from the Tire Pressure Monitoring System (TPMS), which triggers an integer overflow before memory is written. Exploitation of this vulnerability enables attackers to execute arbitrary code within the VCSEC module and send unauthorized messages to the vehicle's CAN bus. Authentication is not required for exploitation.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected vehicle, with the executed code running in the context of the VCSEC module. This could potentially be used to send arbitrary messages to the vehicle's CAN bus, which controls various vehicle functions.

Remediation

This vulnerability has been fixed in Tesla Firmware Version 2024.14.