Tadqiqotchi Renault Navigatsiya Tizimida Yo'lni O'tkazish (Path Traversal) Kamchiligini Topdi — Bu Root Darajasidagi Kodni Bajarishga Imkon Beradi

Zararli SD-karta TomTom Carminat LIVE navigatsiya blokida (ba'zi Renault avtomobillarida ishlatiladi) root darajasidagi kodni bajarishga imkon beradi. Xavfsizlik tadqiqotchisi Rasmus Moorats natijalarni 2026-yil 2-noyabrda e'lon qildi.

U Samsung S5P6440 chipidan foydalanadi va TomTomning maxsus operatsion tizimida ishlaydi, u Linux 2.6.28.10 asosida qurilgan. Bu yadro juda eski va ko'plab zamonaviy ekspluatatsiya himoyalaridan oldin yaratilgan.

Har safar yuklanishda blok SD-kartada master.script nomli faylni qidiradi. Foydalanuvchi "master.scriptni bajarish?" so'rovida "Ha" tugmasini bosishi kerak, shundan keyin u ishga tushadi.

Skript menyu harakatlari uchun maxsus avtomatlashtirish tilidan foydalanadi. Uni tahlil qiladigan ttn dasturi root huquqlari bilan ishlaydi, shuning uchun tahlilchidagi har qanday kamchilik to'liq tizimni egallashga olib kelishi mumkin.

Moorats tahlilchida ikkita zaiflikni topdi. LOG buyrug'i skript nomlagan faylga chop etiladigan matnning bir qatorini yozadi.

U yo'lni tozalamaydi, shuning uchun ../ ketma-ketligi skriptga mo'ljallangan jurnal papkasidan tashqariga yozish imkonini beradi. Bu klassik yo'lni o'tkazish (path traversal) kamchiligi. SHEX buyrug'i qurilmada allaqachon mavjud bo'lgan dasturni ishga tushiradi, lekin u argumentlarni uzata olmaydi.

Moorats 2014-yilgi Renault Latitude avtomobilidagi soatni tuzatmoqchi edi. Bu kichik maqsad uni "beaumont" kod nomli bosh blokka olib keldi. nns.said.

Dastlab ikkala kamchilik ham foydali ko'rinmadi. Root fayl tizimi faqat o'qish (read-only) rejimida edi, va deyarli har bir boshqa bo'lim, jumladan SD-karta, noexec (bajarishni taqiqlovchi) rejimida o'rnatilgan edi, bu esa o'sha bo'limlardan dasturlarni to'g'ridan-to'g'ri bajarishni bloklaydi.

Moorats Linux yadro ekspluatatsiyasidan tanish bo'lgan usulni oldi. U LOG kamchiligidan foydalanib /proc/sys/kernel/core_pattern fayliga yozdi — bu sozlama yadroga jarayon ishdan chiqqanda nima qilishni aytadi.

Romeo zaifligi (Manba: nns).

Qiymat quvur (pipe) belgisi bilan boshlanganda, yadro nomlangan dasturni ishga tushiradi va unga ishdan chiqqan ma'lumotlarni uzatadi. U uni |/bin/sh /media/sdcard/payload.sh qilib o'rnatdi.

Noexec bayrog'i buni bloklamadi, chunki /bin/sh bajariladigan bo'limdagi ikkilik fayl. Qobiq (shell) faqat SD-kartadagi yuklamani ma'lumot sifatida o'qiydi.

Keyin SHEX /bin/dbus-monitor ni ishga tushirdi, u tizim avtobusini topa olmaganda ishdan chiqadi. Yadro ishdan chiqishni hujumchining skriptini root huquqlari bilan ishga tushirish orqali hal qildi.

Butun ekspluatatsiya uch qator: ../../proc/sys/kernel/core_pattern ga ishora qiluvchi #define LOGFILE direktivasi, quvur yuklamasini o'z ichiga olgan LOG qatori, va /bin/dbus-monitor ga SHEX chaqiruvi.

Birinchi isbot kontsepti (proof of concept) shunchaki blokni qayta yukladi, bu root darajasidagi kod bajarilishini tasdiqladi. Moorats keyin bu kirishdan foydalanib ichki eMMC xotirasini dd bilan zaxiraladi. Shuningdek, u settings.dat faylini tahrirlab vaqt zonasini UTC+2 ga o'zgartirdi, bu esa uning asl muammosini hal qildi.

Hujum avtomobilga jismoniy kirishni talab qiladi, va foydalanuvchi skript so'rovini qabul qilishi kerak. Bu masofaviy yoki ommaviy ekspluatatsiyani ehtimoldan yiroq qiladi.

Realistik xavflar — valet xizmati yoki ta'mirlash paytida berilgan buzilgan SD-karta, yoki ijtimoiy muhandislik (social engineering) ssenariysi.

Root kirishi shuningdek, navigatsiya tarixi kabi saqlangan ma'lumotlarni ochib qo'yadi va blokni doimiy o'zgartirishga imkon berishi mumkin. Tadqiqotchining ishi shuni ko'rsatadiki, blokning boshqa himoyalari hujumni to'xtata olmadi.

A malicious SD card can give an attacker root-level code execution on the TomTom Carminat LIVE navigation unit used in some Renault cars. Security researcher Rasmus Moorats published the findings on November 2, 2026.

It uses a Samsung S5P6440 chip and runs TomTom’s custom operating system, which is based on Linux 2.6.28.10. That kernel is very old, and it predates many modern exploit mitigations.

At every boot the unit looks for a file called master.script on the SD card. The user must press “Yes” at an “Execute master.script?” prompt before it runs.

The script uses a custom automation language for menu actions. The ttn program that parses it runs as root, so any flaw in the parser can lead to full compromise.

Moorats found two weaknesses in the parser. The LOG command writes one line of printable text to a file the script names.

It does not sanitize the path, so a ../ sequence lets the script write outside the intended log folder. This is a classic path traversal flaw. The SHEX command runs a program already on the device, but it cannot pass arguments.

Moorats wanted to fix the clock on his 2014 Renault Latitude. That small goal led him to the head unit, codenamed “beaumont.” nns.said.

Neither flaw looked useful at first. The root filesystem was read-only, and nearly every other partition, including the SD card, was mounted noexec, which blocks direct execution of programs from those partitions.

Moorats borrowed a technique familiar from Linux kernel exploitation. He used the LOG flaw to write into /proc/sys/kernel/core_pattern, the setting that tells the kernel what to do when a process crashes.

Romeo vulnerability (Source : nns).

When the value begins with a pipe character, the kernel runs the named program and feeds it the crash data. He set it to |/bin/sh /media/sdcard/payload.sh.

The noexec flag did not block this, because /bin/sh is a binary on an executable partition. The shell only reads the payload from the SD card as data.

SHEX then launched /bin/dbus-monitor, which crashes when it cannot find the system bus. The kernel handled the crash by running the attacker’s script with root privileges.

The whole exploit is three lines: a #define LOGFILE directive pointing at ../../proc/sys/kernel/core_pattern, a LOG line carrying the pipe payload, and a SHEX call to /bin/dbus-monitor.

The first proof of concept simply rebooted the unit, which confirmed root code execution. Moorats then used the access to back up the internal eMMC storage with dd. He also edited settings.dat to change the timezone to UTC+2, which solved his original problem.

The attack needs physical access to the car, and a user must accept the script prompt. That makes remote or mass exploitation unlikely.

The realistic risks are a tampered SD card handed over during valet service or repair, or a social-engineering scenario.

Root access also exposes stored data such as navigation history, and it could allow persistent modification of the unit. The researcher’s work shows that the unit’s other defenses did not stop the attack.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.