Alps Alpine Bluetooth Stack Buffer Overflow Vulnerability in Bosch Infotainment ECU on Nissan Leaf ZE1

A stack-based buffer overflow vulnerability has been identified in the Bluetooth stack developed by Alps Alpine, specifically within the Infotainment ECU manufactured by Bosch for the Nissan Leaf ZE1 model from 2020. This vulnerability arises from improper boundary validation of user-supplied data, allowing an attacker to exploit the issue by sending a specific packet over an established L2CAP channel. Successfully leveraging this vulnerability could result in remote code execution on the affected Infotainment ECU with root privileges.

Impact

Exploitation of this vulnerability allows for remote code execution on the Infotainment ECU, with the executed code running with root privileges.