Automotive Software Vulnerabilities Pose Growing Risk to Vehicle Safety
Researchers highlight the significant and growing number of known vulnerabilities within the complex software stacks powering modern vehicles, raising concerns about safety and functionality.
Modern vehicles are increasingly reliant on sophisticated software, transforming them from mechanical machines into complex, connected computers on wheels. This evolution, while enabling features like app stores, over-the-air updates, and advanced driver-assistance systems, also introduces a substantial attack surface. Researchers at Télécom SudParis have developed a scanner named VERA to assess the known vulnerabilities within the operating systems commonly found in cars, revealing a significant backlog of publicly documented flaws.
The study highlights the difficulty in precisely identifying the software running in vehicles, as car manufacturers often treat this information as proprietary. However, their analysis indicates that popular platforms like Automotive Grade Linux and Android, found in vehicles from manufacturers such as BMW and Tesla, carry a large number of documented vulnerabilities. For instance, one tested version of Automotive Grade Linux was found to have 1,203 known flaws, while Android also presented a substantial count. Even safety-focused systems like QNX Neutrino and VxWorks, despite their security certifications, were found to have dozens of known vulnerabilities.
While the sheer volume of vulnerabilities might seem alarming, the researchers emphasize that a logged vulnerability does not automatically translate to an exploitable risk. The actual threat depends on numerous factors, including whether the vulnerable code is active, accessible to an attacker, and if specific environmental conditions align. The study demonstrated this by successfully exploiting a SQLite vulnerability on Android Automotive and a service discovery protocol (SOME/IP) on Red Hat's AutoSD and Tesla's software, while the same SOME/IP attack failed on Android Automotive due to platform-specific configurations.
Traditional vulnerability scanning tools often struggle with the unique nature of automotive software environments. Cars do not present a standardized or easily inventoryable system, leading to high rates of false positives or missed vulnerabilities. VERA aims to address this by filtering out flaws in non-critical components or developer tools that are unlikely to be exposed in a locked-down vehicle, providing a more focused and actionable list of potential risks.
The research underscores that the software running in vehicles shares a lineage with general-purpose computing, inheriting its historical vulnerability landscape. The challenge for the automotive industry lies not just in the number of known flaws, but in discerning which of these vulnerabilities are realistically exploitable within the constrained and complex environment of a car.
This growing reliance on software means that manufacturers must prioritize robust security practices throughout the development lifecycle. Addressing these vulnerabilities requires a deep understanding of the specific software stack, its configurations, and the potential attack vectors unique to the automotive context. The findings suggest a critical need for enhanced security auditing and patching strategies within the automotive sector to ensure the safety and integrity of connected vehicles.
As vehicles become more integrated with external networks and services, the potential impact of these software flaws extends beyond mere inconvenience. Exploited vulnerabilities could compromise critical safety systems, lead to data breaches, or enable unauthorized control of vehicle functions, posing a direct threat to drivers and passengers. The automotive industry faces a significant challenge in managing this evolving threat landscape.