God Mode On: how we attacked a vehicle’s head unit modem

Researchers have demonstrated a scenario in which a vehicle’s head unit could be controlled remotely after compromising its modem, including the remote execution of code and the potential to run Doom on the head unit as part of their demonstration.

The investigation focused on the Unisoc UIS7862A modem found on the head unit of a Chinese car and identified several critical vulnerabilities across the modem’s cellular protocol stack, including a stack-based overflow in the 3G RLC implementation (CVE-2024-39432) that could enable remote code execution at early connection stages. They also describe a remote-access vulnerability (CVE-2024-39431) that could bypass existing 3G protections by exploiting the RLC layer to run code on the modem.

The researchers detail how they achieved persistence by exploiting an AT command handler to move data to RAM and using Return Oriented Programming to overwrite return addresses and patch the NAS protocol handler, ultimately enabling two-way communication with the modem. They further explain how they leveraged MPU settings and a patch to patch the code section, enabling the NAS protocol to deliver further payloads.

The full version of the article with additional details is available on the ICS CERT website according to Kaspersky ICS CERT. The study underscores that gaining code execution on the modem is only the entry point to potentially compromising the AP and the overall system.