CVE-2024-6348: Nissan Blind Spot ECU Auth Bypass Flaw

CVE-2024-6348 Overview

CVE-2024-6348 is an Insecure Random Number Generation vulnerability affecting the Blind Spot Protection Sensor ECU in the 2022 Nissan Altima. The vulnerability exists in the security access mechanism of the Unified Diagnostic Services (UDS) protocol, where predictable seed generation allows attackers to bypass security controls. By performing repeated ECU resets and seed requests, an attacker with adjacent network access can predict the seeds used for authentication and gain unauthorized access to the ECU's diagnostic functions.

Critical Impact

Attackers with physical or adjacent network access to the vehicle's diagnostic network can bypass ECU security controls, potentially enabling unauthorized diagnostic commands, firmware manipulation, or disabling safety-critical blind spot protection features.

Affected Products

• Nissan Altima (2022 model year)
• Nissan Blind Spot Protection Sensor ECU Firmware
• Vehicles equipped with the affected ECU hardware and firmware combination

Discovery Timeline

• August 19, 2024 - CVE-2024-6348 published to NVD
• August 20, 2024 - Last updated in NVD database

Technical Details for CVE-2024-6348

Vulnerability Analysis

This vulnerability stems from a fundamental weakness in the cryptographic seed generation mechanism within the UDS security access implementation. The Unified Diagnostic Services (UDS) protocol, standardized under ISO 14229, is widely used in automotive systems for diagnostic communication between external tools and vehicle ECUs. A critical security feature within UDS is the Security Access service (0x27), which implements a seed-key challenge-response authentication mechanism to protect sensitive diagnostic functions.

In the affected Nissan Blind Spot Protection Sensor ECU, the seed generation algorithm produces values that are insufficiently random or follow a predictable pattern. When an attacker repeatedly resets the ECU and requests new seeds, they can observe patterns that allow prediction of future seed values. Once the seed can be predicted, calculating the correct key response becomes trivial, effectively bypassing the security access protection entirely.

The attack requires adjacent network access, meaning the attacker must have physical access to the vehicle's CAN bus network, typically through the OBD-II diagnostic port or by compromising another connected ECU.

Root Cause

The root cause is classified as CWE-330: Use of Insufficiently Random Values. The ECU's security access mechanism relies on a pseudo-random number generator (PRNG) that either uses a weak algorithm, an insufficient seed source, or resets to a predictable state upon ECU restart. This implementation flaw allows the seed sequence to be predicted after observing a limited number of seed responses, undermining the entire challenge-response authentication scheme.

Attack Vector

The attack exploits the adjacent network attack vector, requiring the attacker to have access to the vehicle's internal diagnostic network. The exploitation process involves:

1. Connecting to the vehicle's CAN bus, typically via the OBD-II port
2. Sending UDS diagnostic messages to the Blind Spot Protection Sensor ECU
3. Requesting security access seeds multiple times while resetting the ECU between requests
4. Analyzing the collected seeds to identify the generation pattern or algorithm weakness
5. Predicting future seeds and calculating the corresponding keys to authenticate successfully

The vulnerability is characterized by low attack complexity with no privileges required and no user interaction needed. The attacker can perform confidentiality-impacting operations on both the targeted ECU and potentially connected subsystems.

Detection Methods for CVE-2024-6348

Indicators of Compromise

• Unusual volume of UDS Security Access (service 0x27) requests on the CAN bus
• Repeated ECU reset commands followed by immediate seed requests
• Multiple failed security access attempts followed by successful authentication
• Diagnostic session activity from unexpected or unauthorized sources

Detection Strategies

• Monitor CAN bus traffic for abnormal patterns of ECU reset commands targeting the Blind Spot Protection Sensor ECU
• Implement intrusion detection systems (IDS) capable of analyzing UDS protocol traffic for security access abuse patterns
• Log and alert on repeated security access seed requests within short time windows
• Correlate OBD-II port access events with diagnostic message activity

Monitoring Recommendations

• Deploy automotive network monitoring solutions that understand UDS protocol semantics
• Establish baseline diagnostic communication patterns for the vehicle and alert on deviations
• Consider physical port protection mechanisms to restrict unauthorized OBD-II access
• Implement vehicle security operations center (VSOC) monitoring for fleet vehicles

How to Mitigate CVE-2024-6348

Immediate Actions Required

• Restrict physical access to the vehicle's OBD-II diagnostic port using locking mechanisms
• Contact Nissan dealership service departments to inquire about ECU firmware updates
• Monitor for official security bulletins from Nissan regarding this vulnerability
• For fleet operators, implement enhanced physical security controls for parked vehicles

Patch Information

At the time of publication, no official vendor patch information is available. Vehicle owners and fleet operators should monitor the ASRG Security Advisories page and Nissan's official channels for firmware update announcements. ECU firmware updates for automotive systems typically require dealer service appointments and specialized diagnostic equipment.

Workarounds

• Install OBD-II port locks or disable OBD-II access when not in use for authorized diagnostics
• Implement CAN bus intrusion detection solutions that can identify and alert on suspicious UDS traffic patterns
• For high-security applications, consider CAN bus gateway devices that filter unauthorized diagnostic requests
• Restrict vehicle access in secure parking environments to limit physical attack opportunities

# Note: Automotive ECU firmware updates cannot be applied through standard configuration commands.
# Contact your Nissan dealership for authorized firmware update procedures.
# Physical mitigation example: OBD-II port protection
# 1. Install an OBD-II port lock device when vehicle is unattended
# 2. Keep detailed logs of all authorized diagnostic sessions
# 3. Implement telematics monitoring if available for your vehicle