Researcher Demonstrates Zero-Click Bluetooth RCE on Alpine Infotainment System

Summary

Mikhail Evdokimov demonstrated a zero-click Bluetooth exploit against an Alpine infotainment system, achieving a root reverse shell. He said Alpine chose not to release a patch after the vulnerability was reported.

Key points

• A use-after-free flaw in Bluetooth packet reassembly was reachable before authentication and required no user interaction.
• The exploit converted the flaw into heap overflow, arbitrary read and write, and memory-spraying primitives.
• The researcher demonstrated a root reverse shell after forcing the device to connect to an access point; he reported 96% exploit stability after improvements.
• Potential impacts include access to contacts, call history, GPS coordinates and connected microphones, as well as attacks on connected phones or a CAN bus adapter.
• Evdokimov said the vulnerability was reported through ZDI, but Alpine chose not to release a patch.