Challenge Information - CROMU_00054

Commonly known as: ECM_TCM_Simulator


Rounds Enabled

30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44

Details

Original Versions

Known Vulnerabilities

  • CWE-125 - Out-of-bounds Read
  • CWE-200 - Information Exposure
  • CWEs are listed as indicated by the challenge author.

Deployed patches

Deployed IDS rules

None

Author Information

"Jason Williams" jdw@cromulence.com

DARPA performer group

Cromulence LLC (CROMU)

Description

This service is a simulator for an ECM and TCM controller modules. The Engine Computer Module and Traction Controller Module reside on a common shared LAN bus. The simulation allows the user to send preformatted messages or custom binary messages on the shared bus during the simulation. This service is written in C++ and leverages two new CUtil classes a doubly linked list and string class.

ShortDescription: Simulator for an ECM (Engine Computer Module) and TCM (Traction Controller Module).

Feature List

This service accepts a set of message bus commands that will be sent at specified command times to any simulation components on the message bus. This message bus is a shared bus between all components. The standard components on the message bus are the ECM and TCM modules at 0x13 and 0x14 addresses respectively. Broadcast messages can be sent to address 0xFF and all components will receive it. The simulation also will relay response messages sent to either address 0x0 or 0xFF during the simulation and ascii hex display the output of the simulation. The ECM module supports engine off/on commands, torque commands, Incoming Air Temperature (IAT), EGR Temperature, and a host of other parameters. The Traction Controller Module supports off/on commands and wheel speed set and read commands. All items on the component bus support an equipment ID, a unique 64-bit number set from the magic page. It is possible to verify the Equipment ID but not read it. Once a simulation is setup and all messages configured the simulation runs a tick counter at 50ms intervals for up to 2 minutes and sends the setup commands over the bus at their specified times and prints any received messages on the shared bus.

Vulnerability

There is one type 2 vulnerability in this service. This vulnerability is in the TCM module on a read wheel speed command. To reach this vulnerability first the ECM and TCM must both be enabled. To do this it is required to turn on the engine on the ECM before sending the enable TCM command. At this point it is possible to issue a read wheel speed. Any read commands sent to the TCM without both being enabled and the engine on will not be processed. The TCM read wheel speed command consists of TLV field specifying the number and index of the wheel to read. Up to 4 wheel indexes can be read. A failure to check the index position allows a read outside the bounds of the array and allows the equipment ID to be read back 16-bits at a time. If the proper indexes are specified: 6,7,8, and 9 the entire 64-bits of the equipment ID can be read back. This will disclose up to 8-bytes from the magic page.

Generic class of vulnerability

Vulnerability 1 of 1: Improper bounds check on a memory buffer. Memory disclosure

CWE classification

Vulnerability 1 of 1: CWE-125: Out-of-bounds Read CWE-200: Information disclosure

Challenges

Authors Subjective Challenge Difficulty: Discovering: Medium (due to resistance to fuzzing and near infinite possible state depth) Proving: Easy Fixing: Easy (add bounds checking)

This CB presents a moderate difficulty in discovery due preliminary to the large surface area to attack and the near infinite state exploration that can occur. This is due to the nature of the service as a simulator and the ability to input a large number of commands into the system. It also requires the ordering of the commands to turn on the engine and enable traction control before it is possible to send the read wheel speed command to disclose the secret page memory.


POV Information

Round Source Destination Result POV Analysis Video
31 CSDS CodeJitsu Failed POV POV Watch
31 CSDS DeepRed Failed POV POV Watch
31 CSDS Disekt Failed POV POV Watch
31 CSDS ForAllSecure Failed POV POV Watch
31 CSDS Shellphish Failed POV POV Watch
31 CSDS TECHx Failed POV POV Watch
31 DeepRed CodeJitsu Failed POV POV Watch
31 DeepRed CSDS Failed POV POV Watch
31 DeepRed Disekt Failed POV POV Watch
31 DeepRed ForAllSecure Failed POV POV Watch
31 DeepRed Shellphish Failed POV POV Watch
31 DeepRed TECHx Failed POV POV Watch
32 CSDS CodeJitsu Failed POV POV Watch
32 CSDS DeepRed Failed POV POV Watch
32 CSDS Disekt Failed POV POV Watch
32 CSDS ForAllSecure Failed POV POV Watch
32 CSDS Shellphish Failed POV POV Watch
32 CSDS TECHx Failed POV POV Watch
32 DeepRed CodeJitsu Failed POV POV Watch
32 DeepRed CSDS Failed POV POV Watch
32 DeepRed Disekt Failed POV POV Watch
32 DeepRed ForAllSecure Failed POV POV Watch
32 DeepRed Shellphish Failed POV POV Watch
32 DeepRed TECHx Failed POV POV Watch
33 CodeJitsu Shellphish Failed POV through defenses POV Watch
33 CSDS CodeJitsu Failed POV POV Watch
33 CSDS DeepRed Failed POV POV Watch
33 CSDS Disekt Failed POV POV Watch
33 CSDS ForAllSecure Failed POV POV Watch
33 CSDS Shellphish Failed POV through defenses POV Watch
33 CSDS TECHx Failed POV POV Watch
33 DeepRed CodeJitsu Failed POV POV Watch
33 DeepRed CSDS Failed POV POV Watch
33 DeepRed Disekt Failed POV POV Watch
33 DeepRed ForAllSecure Failed POV POV Watch
33 DeepRed Shellphish Failed POV through defenses POV Watch
33 DeepRed TECHx Failed POV POV Watch
33 ForAllSecure CodeJitsu Failed POV POV Watch
33 ForAllSecure CSDS Failed POV POV Watch
33 ForAllSecure DeepRed Failed POV POV Watch
33 ForAllSecure Disekt Failed POV POV Watch
33 ForAllSecure Shellphish Failed POV through defenses POV Watch
33 ForAllSecure TECHx Failed POV POV Watch
34 CodeJitsu Shellphish Failed POV through defenses POV Watch
34 CSDS CodeJitsu Failed POV POV Watch
34 CSDS DeepRed Failed POV POV Watch
34 CSDS Disekt Failed POV POV Watch
34 CSDS ForAllSecure Failed POV POV Watch
34 CSDS Shellphish Failed POV through defenses POV Watch
34 CSDS TECHx Failed POV POV Watch
34 DeepRed CodeJitsu Failed POV POV Watch
34 DeepRed CSDS Failed POV POV Watch
34 DeepRed Disekt Failed POV POV Watch
34 DeepRed ForAllSecure Failed POV POV Watch
34 DeepRed Shellphish Failed POV through defenses POV Watch
34 DeepRed TECHx Failed POV POV Watch
34 ForAllSecure CodeJitsu Failed POV POV Watch
34 ForAllSecure CSDS Failed POV POV Watch
34 ForAllSecure DeepRed Failed POV POV Watch
34 ForAllSecure Disekt Failed POV POV Watch
34 ForAllSecure Shellphish Failed POV through defenses POV Watch
34 ForAllSecure TECHx Failed POV POV Watch
35 CSDS CodeJitsu Failed POV POV Watch
35 CSDS DeepRed Failed POV POV Watch
35 CSDS Disekt Failed POV POV Watch
35 CSDS ForAllSecure Failed POV POV Watch
35 CSDS Shellphish Failed POV through defenses POV Watch
35 CSDS TECHx Failed POV POV Watch
35 DeepRed CodeJitsu Failed POV POV Watch
35 DeepRed CSDS Failed POV POV Watch
35 DeepRed Disekt Failed POV POV Watch
35 DeepRed ForAllSecure Failed POV POV Watch
35 DeepRed Shellphish Failed POV through defenses POV Watch
35 DeepRed TECHx Failed POV POV Watch
35 ForAllSecure CodeJitsu Failed POV POV Watch
35 ForAllSecure CSDS Failed POV POV Watch
35 ForAllSecure DeepRed Failed POV POV Watch
35 ForAllSecure Disekt Failed POV POV Watch
35 ForAllSecure Shellphish Failed POV through defenses POV Watch
35 ForAllSecure TECHx Failed POV POV Watch
36 CSDS CodeJitsu Failed POV POV Watch
36 CSDS DeepRed Failed POV POV Watch
36 CSDS Disekt Failed POV POV Watch
36 CSDS ForAllSecure Failed POV POV Watch
36 CSDS Shellphish Failed POV through defenses POV Watch
36 CSDS TECHx Failed POV POV Watch
36 DeepRed CodeJitsu Failed POV POV Watch
36 DeepRed CSDS Failed POV POV Watch
36 DeepRed Disekt Failed POV POV Watch
36 DeepRed ForAllSecure Failed POV POV Watch
36 DeepRed Shellphish Failed POV through defenses POV Watch
36 DeepRed TECHx Failed POV POV Watch
36 ForAllSecure CodeJitsu Failed POV POV Watch
36 ForAllSecure CSDS Failed POV POV Watch
36 ForAllSecure DeepRed Failed POV POV Watch
36 ForAllSecure Disekt Failed POV POV Watch
36 ForAllSecure Shellphish Failed POV through defenses POV Watch
36 ForAllSecure TECHx Failed POV POV Watch
37 CSDS CodeJitsu Failed POV POV Watch
37 CSDS DeepRed Failed POV POV Watch
37 CSDS Disekt Failed POV POV Watch
37 CSDS ForAllSecure Failed POV POV Watch
37 CSDS Shellphish Failed POV through defenses POV Watch
37 CSDS TECHx Failed POV POV Watch
37 DeepRed CodeJitsu Failed POV POV Watch
37 DeepRed CSDS Failed POV POV Watch
37 DeepRed Disekt Failed POV POV Watch
37 DeepRed ForAllSecure Failed POV POV Watch
37 DeepRed Shellphish Failed POV through defenses POV Watch
37 DeepRed TECHx Failed POV POV Watch
37 ForAllSecure CodeJitsu Failed POV POV Watch
37 ForAllSecure CSDS Failed POV POV Watch
37 ForAllSecure DeepRed Failed POV POV Watch
37 ForAllSecure Disekt Failed POV POV Watch
37 ForAllSecure Shellphish Failed POV through defenses POV Watch
37 ForAllSecure TECHx Failed POV POV Watch
38 CSDS CodeJitsu Failed POV POV Watch
38 CSDS DeepRed Failed POV POV Watch
38 CSDS Disekt Failed POV POV Watch
38 CSDS ForAllSecure Failed POV POV Watch
38 CSDS Shellphish Failed POV through defenses POV Watch
38 CSDS TECHx Failed POV POV Watch
38 DeepRed CodeJitsu Failed POV POV Watch
38 DeepRed CSDS Failed POV POV Watch
38 DeepRed Disekt Failed POV POV Watch
38 DeepRed ForAllSecure Failed POV POV Watch
38 DeepRed Shellphish Failed POV through defenses POV Watch
38 DeepRed TECHx Failed POV POV Watch
38 ForAllSecure CodeJitsu Failed POV POV Watch
38 ForAllSecure CSDS Failed POV POV Watch
38 ForAllSecure DeepRed Failed POV POV Watch
38 ForAllSecure Disekt Failed POV POV Watch
38 ForAllSecure Shellphish Failed POV through defenses POV Watch
38 ForAllSecure TECHx Failed POV POV Watch
39 CSDS CodeJitsu Failed POV POV Watch
39 CSDS DeepRed Failed POV POV Watch
39 CSDS Disekt Failed POV POV Watch
39 CSDS ForAllSecure Failed POV POV Watch
39 CSDS Shellphish Failed POV through defenses POV Watch
39 CSDS TECHx Failed POV POV Watch
39 DeepRed CodeJitsu Failed POV POV Watch
39 DeepRed CSDS Failed POV POV Watch
39 DeepRed Disekt Failed POV POV Watch
39 DeepRed ForAllSecure Failed POV POV Watch
39 DeepRed Shellphish Failed POV through defenses POV Watch
39 DeepRed TECHx Failed POV POV Watch
39 ForAllSecure CodeJitsu Failed POV POV Watch
39 ForAllSecure CSDS Failed POV POV Watch
39 ForAllSecure DeepRed Failed POV POV Watch
39 ForAllSecure Disekt Failed POV POV Watch
39 ForAllSecure Shellphish Failed POV through defenses POV Watch
39 ForAllSecure TECHx Failed POV POV Watch
40 CSDS CodeJitsu Failed POV POV Watch
40 CSDS DeepRed Failed POV POV Watch
40 CSDS Disekt Failed POV POV Watch
40 CSDS ForAllSecure Failed POV POV Watch
40 CSDS Shellphish Failed POV through defenses POV Watch
40 CSDS TECHx Failed POV POV Watch
40 DeepRed CodeJitsu Failed POV POV Watch
40 DeepRed CSDS Failed POV POV Watch
40 DeepRed Disekt Failed POV POV Watch
40 DeepRed ForAllSecure Failed POV POV Watch
40 DeepRed Shellphish Failed POV through defenses POV Watch
40 DeepRed TECHx Failed POV POV Watch
40 ForAllSecure CodeJitsu Failed POV POV Watch
40 ForAllSecure CSDS Failed POV POV Watch
40 ForAllSecure DeepRed Failed POV POV Watch
40 ForAllSecure Disekt Failed POV POV Watch
40 ForAllSecure Shellphish Failed POV through defenses POV Watch
40 ForAllSecure TECHx Failed POV POV Watch
41 CSDS CodeJitsu Failed POV POV Watch
41 CSDS DeepRed Failed POV POV Watch
41 CSDS Disekt Failed POV POV Watch
41 CSDS ForAllSecure Failed POV POV Watch
41 CSDS Shellphish Failed POV through defenses POV Watch
41 CSDS TECHx Failed POV POV Watch
41 DeepRed CodeJitsu Failed POV POV Watch
41 DeepRed CSDS Failed POV POV Watch
41 DeepRed Disekt Failed POV POV Watch
41 DeepRed ForAllSecure Failed POV POV Watch
41 DeepRed Shellphish Failed POV through defenses POV Watch
41 DeepRed TECHx Failed POV POV Watch
41 ForAllSecure CodeJitsu Failed POV POV Watch
41 ForAllSecure CSDS Failed POV POV Watch
41 ForAllSecure DeepRed Failed POV POV Watch
41 ForAllSecure Disekt Failed POV POV Watch
41 ForAllSecure Shellphish Failed POV through defenses POV Watch
41 ForAllSecure TECHx Failed POV POV Watch
42 CodeJitsu Shellphish Failed POV POV Watch
42 CSDS CodeJitsu Failed POV POV Watch
42 CSDS DeepRed Failed POV POV Watch
42 CSDS Disekt Failed POV POV Watch
42 CSDS ForAllSecure Failed POV POV Watch
42 CSDS Shellphish Failed POV POV Watch
42 CSDS TECHx Failed POV POV Watch
42 DeepRed CodeJitsu Failed POV POV Watch
42 DeepRed CSDS Failed POV POV Watch
42 DeepRed Disekt Failed POV POV Watch
42 DeepRed ForAllSecure Failed POV POV Watch
42 DeepRed Shellphish Failed POV POV Watch
42 DeepRed TECHx Failed POV POV Watch
42 ForAllSecure CodeJitsu Failed POV POV Watch
42 ForAllSecure CSDS Failed POV POV Watch
42 ForAllSecure DeepRed Failed POV POV Watch
42 ForAllSecure Disekt Failed POV POV Watch
42 ForAllSecure Shellphish Failed POV POV Watch
42 ForAllSecure TECHx Failed POV POV Watch
43 CSDS CodeJitsu Failed POV POV Watch
43 CSDS DeepRed Failed POV POV Watch
43 CSDS Disekt Failed POV POV Watch
43 CSDS ForAllSecure Failed POV POV Watch
43 CSDS Shellphish Failed POV POV Watch
43 CSDS TECHx Failed POV POV Watch
43 DeepRed CodeJitsu Failed POV POV Watch
43 DeepRed CSDS Failed POV POV Watch
43 DeepRed Disekt Failed POV POV Watch
43 DeepRed ForAllSecure Failed POV POV Watch
43 DeepRed Shellphish Failed POV POV Watch
43 DeepRed TECHx Failed POV POV Watch
43 ForAllSecure CodeJitsu Failed POV POV Watch
43 ForAllSecure CSDS Failed POV POV Watch
43 ForAllSecure DeepRed Failed POV POV Watch
43 ForAllSecure Disekt Failed POV POV Watch
43 ForAllSecure Shellphish Failed POV POV Watch
43 ForAllSecure TECHx Failed POV POV Watch
44 CSDS CodeJitsu Failed POV POV Watch
44 CSDS DeepRed Failed POV POV Watch
44 CSDS Disekt Failed POV POV Watch
44 CSDS ForAllSecure Failed POV POV Watch
44 CSDS Shellphish Failed POV POV Watch
44 CSDS TECHx Failed POV POV Watch
44 DeepRed CodeJitsu Failed POV POV Watch
44 DeepRed CSDS Failed POV POV Watch
44 DeepRed Disekt Failed POV POV Watch
44 DeepRed ForAllSecure Failed POV POV Watch
44 DeepRed Shellphish Failed POV POV Watch
44 DeepRed TECHx Failed POV POV Watch
44 ForAllSecure CodeJitsu Failed POV POV Watch
44 ForAllSecure CSDS Failed POV POV Watch
44 ForAllSecure DeepRed Failed POV POV Watch
44 ForAllSecure Disekt Failed POV POV Watch
44 ForAllSecure Shellphish Failed POV POV Watch
44 ForAllSecure TECHx Failed POV POV Watch

Curated by Lunge Technology, LLC. Questions or comments? Send us email