{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-8357", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "state": "PUBLISHED", "assignerShortName": "zdi", "dateReserved": "2024-08-30T16:16:08.490Z", "datePublished": "2024-11-22T21:32:58.640Z", "dateUpdated": "2024-11-25T01:43:36.596Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2024-11-22T21:32:58.640Z"}, "title": "Visteon Infotainment App SoC Missing Immutable Root of Trust in Hardware Local Privilege Escalation Vulnerability", "descriptions": [{"lang": "en", "value": "Visteon Infotainment App SoC Missing Immutable Root of Trust in Hardware Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Visteon Infotainment systems. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.\n\nThe specific flaw exists within the configuration of the application system-on-chip (SoC). The issue results from the lack of properly configured hardware root of trust. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the boot process. Was ZDI-CAN-23759."}], "affected": [{"vendor": "Visteon", "product": "Infotainment", "versions": [{"version": "cmu150_NA_74.00.324A", "status": "affected"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-1326", "description": "CWE-1326: Missing Immutable Root of Trust in Hardware", "type": "CWE"}]}], "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-1189/", "name": "ZDI-24-1189", "tags": ["x_research-advisory"]}], "dateAssigned": "2024-08-30T11:16:08.479-05:00", "datePublic": "2024-08-30T11:22:26.416-05:00", "source": {"lang": "en", "value": "Dmitry \"InfoSecDJ\" Janushkevich of Trend Micro Zero Day Initiative"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-8357", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-11-25T01:35:17.943794Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:visteon:infotainment:cmu150_na_74.00.324a:*:*:*:*:*:*:*"], "vendor": "visteon", "product": "infotainment", "versions": [{"status": "affected", "version": "cmu150_na_74.00.324a"}], "defaultStatus": "unknown"}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-25T01:43:36.596Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-8357", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-11-25T01:35:17.943794Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:visteon:infotainment:cmu150_na_74.00.324a:*:*:*:*:*:*:*"], "vendor": "visteon", "product": "infotainment", "versions": [{"status": "affected", "version": "cmu150_na_74.00.324a"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-25T01:36:21.911Z"}}], "cna": {"title": "Visteon Infotainment App SoC Missing Immutable Root of Trust in Hardware Local Privilege Escalation Vulnerability", "source": {"lang": "en", "value": "Dmitry \"InfoSecDJ\" Janushkevich of Trend Micro Zero Day Initiative"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "Visteon", "product": "Infotainment", "versions": [{"status": "affected", "version": "cmu150_NA_74.00.324A"}], "defaultStatus": "unknown"}], "datePublic": "2024-08-30T11:22:26.416-05:00", "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-1189/", "name": "ZDI-24-1189", "tags": ["x_research-advisory"]}], "dateAssigned": "2024-08-30T11:16:08.479-05:00", "descriptions": [{"lang": "en", "value": "Visteon Infotainment App SoC Missing Immutable Root of Trust in Hardware Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Visteon Infotainment systems. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.\n\nThe specific flaw exists within the configuration of the application system-on-chip (SoC). The issue results from the lack of properly configured hardware root of trust. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the boot process. Was ZDI-CAN-23759."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1326", "description": "CWE-1326: Missing Immutable Root of Trust in Hardware"}]}], "providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2024-11-22T21:32:58.640Z"}}}, "cveMetadata": {"cveId": "CVE-2024-8357", "state": "PUBLISHED", "dateUpdated": "2024-11-25T01:43:36.596Z", "dateReserved": "2024-08-30T16:16:08.490Z", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "datePublished": "2024-11-22T21:32:58.640Z", "assignerShortName": "zdi"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:visteon:infotainment:cmu150_na_74.00.324a:*:*:*:*:*:*:*", "matchCriteriaId": "1BF7F7D0-58F8-4A04-9519-7F9D8D9326E8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Visteon Infotainment App SoC Missing Immutable Root of Trust in Hardware Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Visteon Infotainment systems. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.\n\nThe specific flaw exists within the configuration of the application system-on-chip (SoC). The issue results from the lack of properly configured hardware root of trust. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the boot process. Was ZDI-CAN-23759."}, {"lang": "es", "value": "Vulnerabilidad de escalado de privilegios locales de hardware en el SoC de la aplicaci\u00f3n Visteon Infotainment que carece de una ra\u00edz de confianza inmutable. Esta vulnerabilidad permite a los atacantes locales escalar privilegios en las instalaciones afectadas de los sistemas de Visteon Infotainment. Aunque se requiere autenticaci\u00f3n para explotar esta vulnerabilidad, se puede omitir el mecanismo de autenticaci\u00f3n existente. La falla espec\u00edfica existe dentro de la configuraci\u00f3n del sistema en chip (SoC) de la aplicaci\u00f3n. El problema es el resultado de la falta de una ra\u00edz de confianza de hardware configurada correctamente. Un atacante puede aprovechar esta vulnerabilidad para escalar privilegios y ejecutar c\u00f3digo arbitrario en el contexto del proceso de arranque. Era ZDI-CAN-23759."}], "id": "CVE-2024-8357", "lastModified": "2024-12-11T04:05:34.840", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-11-22T22:15:19.107", "references": [{"source": "zdi-disclosures@trendmicro.com", "tags": ["Third Party Advisory"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-1189/"}], "sourceIdentifier": "zdi-disclosures@trendmicro.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1326"}], "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}