Hackers Could Take Control of Car Dashboard by Hacking Its Modem

Securelist researchers identified a critical stack-based buffer overflow in the Unisoc UIS7862A modem used in many vehicle head units. By sending a single malformed 3G RLC packet with excessive optional headers, an attacker can overflow a 0xB4-byte stack buffer (packet can be up to 0x5F0 bytes), overwrite the return address, and use ROP techniques to achieve remote code execution on the modem, pivot to the application processor, patch memory protections, compromise the Android kernel, and run arbitrary applications on the car dashboard.