7 ms·

It looks like a car would need to be over 2 years behind Tesla's OTA updates for it to still have version 2.6.36 and be vulnerable to this exploit. https://ele

by slg 7y ago

It looks like a car would need to be over 2 years behind Tesla's OTA updates for it to still have version 2.6.36 and be vulnerable to this exploit. https://electrek.co/2017/06/30/tesla-new-linux-kernel-update-ui-improvements/ https://electrek.co/2017/06/30/tesla-new-linux-kernel-update... EDIT: See nils2014's comments below. The WiFi chip is connected to the entertainment system which received an updated kernel, but it is seems like the kernel on the WiFi chip itself may not have been updated.

cjbprime 7y ago
(Note that this article is only talking about the dashboard entertainment machine, which probably isn't the one the wifi chip's connected to. Perhaps that one got slower updates.)
nils2014 7y ago
The kernel version of the information center is irrelevant. The Wi-Fi stack is running on a separate module (the Parrot module, as mentioned in the article), which runs its own obsolete linux version.
- cjbprime 7y ago
  I wonder if there's a way to find out which kernel version Parrot runs today.
  - stefan_ 7y ago
    Do they even still exist? It's impossible to find anything on these modules beyond FCC filings; some pixelated datasheets show the modules with "www.parrot.com" printed on them but going as far back as 2017 in the WWW archive, that site belongs to some drone startup.
    - cjbprime 7y ago
      What do you mean by "still exist"? Obviously a vuln was found in one that was inside a Model S, reported to Tesla and fixed.
      - stefan_ 7y ago
        Marvel fixed the bug in their firmware and apparently Tesla shipped some sort of update, I don't see anything that necessarily requires Parrot, the obscure maker of these modules, to do anything.
        cjbprime 7y ago
        Oh! You misunderstood my question: I meant to ask whether Tesla's latest software update continues to ship a 2.6.36 kernel on Parrot, or a newer kernel instead, as they do for their other modules. (Tesla uses the name Parrot to refer to this system in the car.) A reason for them not to still be on 2.6.36 is that it's deeply exploitable.
        stefan_ 7y ago
        I think the root of the confusion here is that you think Parrot is just a Tesla nickname. But Parrot is the name of the manufacturer of the fully-integrated WiFi+Bluetooth module so Tesla likely have nothing to do with the firmware that runs on that module with the ancient kernel. As far as I can tell, Parrot-the-module-maker split from Parrot-the-drone-company and is now http://parrot-faurecia-automotive.com http://parrot-faurecia-automotive.com
        cjbprime 7y ago
        Oh, I didn't get that impression. Keen's previous Black Hat paper made it sound like Tesla is dual-maintaining 2.6.36 and 4.x kernels, because they're unable/unwilling to upgrade from 2.6.36 on the Parrot board but are still issuing kernel fixes for it.
        stefan_ 7y ago

by slg 7y ago

cjbprime 7y ago

(Note that this article is only talking about the dashboard entertainment machine, which probably isn't the one the wifi chip's connected to. Perhaps that one got slower updates.)

nils2014 7y ago

The kernel version of the information center is irrelevant. The Wi-Fi stack is running on a separate module (the Parrot module, as mentioned in the article), which runs its own obsolete linux version.

cjbprime 7y ago
I wonder if there's a way to find out which kernel version Parrot runs today.
- stefan_ 7y ago
  Do they even still exist? It's impossible to find anything on these modules beyond FCC filings; some pixelated datasheets show the modules with "www.parrot.com" printed on them but going as far back as 2017 in the WWW archive, that site belongs to some drone startup.
  - cjbprime 7y ago
    What do you mean by "still exist"? Obviously a vuln was found in one that was inside a Model S, reported to Tesla and fixed.
    - stefan_ 7y ago
      Marvel fixed the bug in their firmware and apparently Tesla shipped some sort of update, I don't see anything that necessarily requires Parrot, the obscure maker of these modules, to do anything.
      - cjbprime 7y ago
        Oh! You misunderstood my question: I meant to ask whether Tesla's latest software update continues to ship a 2.6.36 kernel on Parrot, or a newer kernel instead, as they do for their other modules. (Tesla uses the name Parrot to refer to this system in the car.) A reason for them not to still be on 2.6.36 is that it's deeply exploitable.
        stefan_ 7y ago
        I think the root of the confusion here is that you think Parrot is just a Tesla nickname. But Parrot is the name of the manufacturer of the fully-integrated WiFi+Bluetooth module so Tesla likely have nothing to do with the firmware that runs on that module with the ancient kernel. As far as I can tell, Parrot-the-module-maker split from Parrot-the-drone-company and is now http://parrot-faurecia-automotive.com http://parrot-faurecia-automotive.com
        cjbprime 7y ago
        Oh, I didn't get that impression. Keen's previous Black Hat paper made it sound like Tesla is dual-maintaining 2.6.36 and 4.x kernels, because they're unable/unwilling to upgrade from 2.6.36 on the Parrot board but are still issuing kernel fixes for it.
        stefan_ 7y ago