Exploiting USB on a Tesla IVI with Raspberry Pi Devices to B...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://nccgroup.com/research/exploiting-usb-on-a-tesla-ivi-with-raspberry-pi-devices-to-bypass-kaslr-insomnihack-2026
• Blog Title: Exploiting USB on a Tesla IVI with Raspberry Pi Devices to Bypass KASLR
• Suggested Section: Binary Exploitation > Linux kernel exploitation and KASLR bypass, with a cross-reference under Hardware/Physical Access > Physical Attacks for malicious USB device orchestration

🎯 Content Summary

Alex Plaskett and Robert Herrera presented this research at InsomniHack Switzerland 2026 on 24 August 2026. The work investigates whether Linux USB vulnerabilities previously associated with mobile-phone compromises can be practically exploited against modern embedded Linux systems, and reports that Tesla's in-vehicle infotainment (IVI) system was also affected by several core Linux kernel USB issues.

Research context: In late 2024, Google Threat Analysis Group reported...

🔧 Technical Details

USB kernel heap grooming: An attacker can attach multiple USB devices through hubs and use the normal enumeration and driver-processing activity of those devices to spray kernel heap allocations. By selecting the device mix and connection arrangement, the attacker attempts to position a useful kernel pointer in a heap chunk adjacent to memory later accessed by a vulnerable parser. This makes an out-of-bounds read more reliable and turns an otherwise unstable memory disclosure into a controlled leak.

USB Audio descriptor out-of-bounds read: A vulnerability in USB Audio descriptor parsing can cause the Linux kernel's clock-source discovery logic to read past the intended memory boundary. A malicious USB device supplies specially crafted Audio descriptors that reach the vulnerable path. If heap grooming has placed pointer data immediately beyond the valid object or descriptor-related memory, the parser reads that adjacent kernel memory and expose...

🤖 Agent Actions

Plan:

1. Map the binary-exploitation and physical/hardware documentation and inspect at least five relevant pages.
2. Compare existing coverage with the supplied research and primary Linux sources.
3. Add only the non-duplicated technique to the best single existing page, with numbered citations.
4. Re-read the result and validate Markdown, links, and the final diff.
   Repository review shows no general Linux-kernel page for this primitive. The existing KASLR page is specific to the arm64 static linear map, while the physical-attacks page only covers HID-style BadUSB. I’ll now inspect the authors’ slides and the upstream Linux fix before deciding whether a focused kernel-exploitation page is warranted.
   The slides add material absent from the summary and repository: the leak is a selector-ID oracle, not a raw byte dump; candidate IDs, window sizing, repeat-value constraints, and a second ordering pass are central. The best placement is therefore a focused Linux-kernel exploitation page, with only a discoverability link from Physical Attacks and a navigation entry.
   Implementation is complete. I’m now validating that the new page is reachable, its references and citations are consistent, no forbidden sources were introduced, the temporary research artifacts are gone, and the diff contains only the intended documentation changes.
   Updated the HackTricks repository:

• Added usb-audio-descriptor-oob-kaslr-leak.md under Linux kernel exploitation.
• Documented:
  • UAC2/UAC3 descriptor-length bug.
  • Selector-ID disclosure oracle and multi-pass byte reconstruction.
  • USB-only kmalloc-512 heap grooming.
  • Multi-device DUET orchestration.
  • Pointer-to-KASLR-base calculation.
  • Upstream patch and audit guidance.
• Added navigation in src/SUMMARY.md.
• Added a cross-reference from hardware-physical-access/physical-attacks.md.
• Included numbered citations to the upstream Linux fix, NCC slides, and blog.

Validation passed: internal paths resolve, forbidden-source scan is clean, and git diff --check reports no errors. mdbook was unavailable locally, so a full build was not run.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://nccgroup.com/research/exploiting-usb-on-a-tesla-ivi-with-raspberry-pi-devices-to-bypass-kaslr-insomnihack-2026

Content Categories: Based on the analysis, this content was categorized under "Binary Exploitation > Linux kernel exploitation and KASLR bypass, with a cross-reference under Hardware/Physical Access > Physical Attacks for malicious USB device orchestration".

Repository Maintenance:

• MD Files Formatting: 1032 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0