CVE-2024-37310: EVerest Buffer Overflow Vulnerability

CVE-2024-37310 Overview

CVE-2024-37310 is a critical integer overflow vulnerability affecting EVerest, an open-source EV (Electric Vehicle) charging software stack. The vulnerability exists in the v2g_incoming_v2gtp function within the v2g_server.cpp implementation, where an integer overflow condition can be exploited by a remote attacker to overflow the process heap. This vulnerability poses significant risks to EV charging infrastructure, potentially allowing attackers to compromise charging stations and execute arbitrary code.

Critical Impact

Remote attackers can exploit this integer overflow to corrupt heap memory, potentially leading to remote code execution on EV charging infrastructure systems without requiring authentication.

Affected Products

• EVerest everest-core versions prior to 2024.3.1
• EVerest everest-core versions prior to 2024.6.0

Discovery Timeline

• July 10, 2024 - CVE-2024-37310 published to NVD
• December 16, 2024 - Last updated in NVD database

Technical Details for CVE-2024-37310

Vulnerability Analysis

This vulnerability is classified under CWE-122 (Heap-based Buffer Overflow). The flaw resides in the V2G (Vehicle-to-Grid) communication protocol implementation within the EVerest charging stack. The v2g_incoming_v2gtp function in v2g_server.cpp fails to properly validate integer values before performing memory allocation or copy operations, resulting in an integer overflow condition. When exploited, this causes subsequent heap memory operations to write beyond allocated buffer boundaries.

The network-accessible nature of this vulnerability is particularly concerning for critical infrastructure. EV charging stations running vulnerable EVerest firmware could be remotely targeted by attackers who can send specially crafted V2G Transport Protocol (V2GTP) messages. The attack requires no user interaction and no prior authentication, though the attack complexity is considered high due to the specific conditions required for successful exploitation.

Root Cause

The root cause of CVE-2024-37310 is improper integer handling in the v2g_incoming_v2gtp function. When processing incoming V2GTP messages, the function accepts user-controlled length values without adequate bounds checking. These values are used in arithmetic operations that can wrap around when sufficiently large values are provided, causing subsequent memory allocation to be smaller than expected. When data is then copied using the original (large) length value, a heap buffer overflow occurs.

Attack Vector

The attack vector for this vulnerability is network-based. An attacker with network access to a vulnerable EV charging station can send maliciously crafted V2GTP packets to the v2g_server component. The attack flow involves:

1. The attacker sends a specially crafted V2GTP message with a malicious length field designed to trigger the integer overflow
2. The integer overflow causes an undersized heap buffer to be allocated
3. Subsequent data copy operations write beyond the allocated buffer boundaries
4. The heap corruption can be leveraged to gain code execution or cause denial of service

The vulnerability can be exploited without any privileges or user interaction, making it particularly dangerous for internet-exposed or network-accessible charging infrastructure.

The vulnerability manifests in the V2GTP message handling code where integer arithmetic is performed on attacker-controlled length values. For technical implementation details and the specific code changes, see the GitHub Security Advisory and the commit that addresses this vulnerability.

Detection Methods for CVE-2024-37310

Indicators of Compromise

• Unusual crash patterns or segmentation faults in the EVerest v2g_server process
• Anomalous network traffic patterns targeting V2GTP communication ports
• Unexpected process restarts or service interruptions on EV charging controllers
• Memory corruption indicators or heap integrity check failures in system logs

Detection Strategies

• Monitor EVerest service logs for crash reports or heap corruption indicators in the v2g_server component
• Implement network intrusion detection rules to identify malformed V2GTP packets with suspicious length fields
• Deploy runtime memory protection mechanisms (such as heap canaries and ASLR) to detect exploitation attempts
• Conduct regular vulnerability scanning to identify EVerest installations running versions prior to 2024.3.1 or 2024.6.0

Monitoring Recommendations

• Enable comprehensive logging for all V2G protocol communications
• Implement alerting on service crashes or unexpected restarts of the EVerest stack
• Monitor network traffic for unusually large or malformed V2GTP message payloads
• Deploy file integrity monitoring on EVerest binary files to detect potential post-exploitation modifications

How to Mitigate CVE-2024-37310

Immediate Actions Required

• Upgrade EVerest everest-core to version 2024.3.1 or 2024.6.0 immediately
• If immediate patching is not possible, implement network segmentation to restrict access to V2G communication interfaces
• Review network access controls to ensure charging stations are not directly exposed to untrusted networks
• Enable available heap protection mechanisms on the host operating system

Patch Information

The EVerest project has released patched versions that address this vulnerability. Organizations should update to version 2024.3.1 or 2024.6.0 which include the fix. The specific commit addressing this vulnerability is available in the EVerest GitHub repository. Release packages are available at EVerest 2024.3.1 and EVerest 2024.6.0.

Workarounds

• Implement strict network segmentation to isolate EV charging infrastructure from untrusted networks
• Deploy a web application firewall or network filtering to inspect and block malformed V2GTP traffic
• Limit network access to the V2G server component to only trusted vehicle communication paths
• Consider disabling V2G functionality temporarily if it is not operationally required until patching is complete

# Network segmentation example using iptables
# Restrict V2G server access to trusted network segment only
iptables -A INPUT -p tcp --dport 15118 -s 192.168.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 15118 -j DROP