Memory Isolation Flaw in MIB3 Infotainment System by Volkswagen

CVE-2023-28907

What is CVE-2023-28907?

A vulnerability in the MIB3 infotainment system utilized in certain Volkswagen and Skoda vehicles allows for a lack of memory isolation between CPU cores. This issue permits an attacker with access to the main operating system to potentially compromise the dedicated CPU core that processes Controller Area Network (CAN) messages, which are crucial for vehicle communication and control. The exploitation of this vulnerability could lead to unauthorized access and manipulation of vehicle functions, raising significant security concerns.

References