From 024b55a2a850ac93e6a2f07909747a5079a2bceb Mon Sep 17 00:00:00 2001 From: KaraZajac Date: Sat, 21 Feb 2026 00:13:14 -0500 Subject: [PATCH] CVE updates --- README.md | 13 +++ src/ui/captures_list.rs | 4 + src/vuln_db.rs | 182 ++++++++++++++++++++++++++++++++++++++-- 3 files changed, 194 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index fd0acea..ef69c92 100644 --- a/README.md +++ b/README.md @@ -239,6 +239,19 @@ Protocol behavior and RF modulation (AM/FM) follow the ProtoPirate reference. KA **KeeLoq generic fallback:** If no protocol decodes a capture, KAT tries KeeLoq with every keystore manufacturer key (Kia V3/V4 and Star Line bit layouts). On success the protocol is shown as **Keeloq (*keystore name*)** (e.g. Keeloq (Alligator), Keeloq (Pandora_PRO)). See [docs/keeloq_generic.md](docs/keeloq_generic.md). +### Vulnerability database + +KAT matches capture metadata (Year / Make / Model / Region, set via **i** on a capture) against a built-in CVE list. The **Vuln Found** column and **Vulnerability** detail panel show matches; each CVE links to the NVD for further reading. + +| CVE | Make(s) | Models | Year range | Description | +|-----|---------|--------|------------|-------------| +| [CVE-2022-38766](https://nvd.nist.gov/vuln/detail/CVE-2022-38766) | Renault | ZOE | 2020–2022 | Replay attack: same rolling code set per door-open request (433.92 MHz). | +| [CVE-2022-27254](https://nvd.nist.gov/vuln/detail/CVE-2022-27254) | Honda | Civic | 2016–2019 | Replay attack: same RF signal per door-open request (related to CVE-2019-20626). | +| [CVE-2022-37418](https://nvd.nist.gov/vuln/detail/CVE-2022-37418) | Honda, Hyundai, Kia, Nissan | Fit (hybrid), Fit, City, Vezel; Elantra; Cerato, Forte, K3; Latio, Sylphy | 2007–2022 (varies by model) | **RollBack attack:** RKE allows unlock and resync after capturing two consecutive key fob signals; attacker can unlock indefinitely. | +| [CVE-2022-36945](https://nvd.nist.gov/vuln/detail/CVE-2022-36945) | Mazda | 3, 2 Sedan, 2 HB (facelift), Cx-3, Cx-5 | 2018–2020 (varies by model) | **RollBack attack:** RKE allows unlock and resync after capturing **three** consecutive key fob signals; attacker can unlock indefinitely. | + +Details (exact model/year scope) are in `src/vuln_db.rs`. The app shows the NVD URL for each matched CVE in the Vulnerability panel. + ### Cryptographic modules - **KeeLoq** — encrypt/decrypt with normal, secure, FAAC, and magic serial/XOR learning key derivation (keeloq_common, keys). Unknown signals are tried as KeeLoq with every keystore key via **keeloq_generic** (uses keeloq_common only). diff --git a/src/ui/captures_list.rs b/src/ui/captures_list.rs index e52d5c4..fc3c70c 100644 --- a/src/ui/captures_list.rs +++ b/src/ui/captures_list.rs @@ -377,6 +377,10 @@ fn render_vulnerability_panel( Span::styled(" Description: ", label_style), Span::styled(v.description, value_style), ])); + lines.push(Line::from(vec![ + Span::styled(" Source: ", label_style), + Span::styled(v.url, value_style), + ])); lines.push(Line::from(Span::raw(""))); } } diff --git a/src/vuln_db.rs b/src/vuln_db.rs index ebe2e6c..8ace392 100644 --- a/src/vuln_db.rs +++ b/src/vuln_db.rs @@ -1,25 +1,34 @@ //! Vulnerability database: CVE entries matched by year range, makes, models, region. //! Used for "Vuln Found" column and the Vulnerability detail panel. +//! +//! Each row has a unique `id` so the same CVE can appear multiple times with different +//! year/make/model scope (e.g. per-model year ranges for CVE-2022-37418). -/// One CVE entry. Year range is inclusive; "ALL" for start/end means no bound. -/// Makes and models are arrays; any match counts. Use ["ALL"] to match any make/model. +/// One vulnerability scope: a single row in the DB. Uniquely identified by `id`. +/// The same CVE can appear in multiple entries with different year/make/model bounds. #[derive(Debug, Clone)] pub struct VulnEntry { + /// Unique id for this row (same CVE can have multiple rows with different scope). Used for tracking and future export/dedupe. + #[allow(dead_code)] + pub id: u32, pub cve: &'static str, /// Inclusive start year (e.g. "2018"). "ALL" = no lower bound. pub year_start: &'static str, /// Inclusive end year (e.g. "2021"). "ALL" = no upper bound. pub year_end: &'static str, - /// Makes that are affected (e.g. ["Renault"], ["Honda", "Acura"]). ["ALL"] = any make. + /// Makes that are affected (e.g. ["Renault"]). ["ALL"] = any make. pub makes: &'static [&'static str], - /// Models that are affected (e.g. ["ZOE"], ["Civic", "Accord"]). ["ALL"] = any model. + /// Models that are affected (e.g. ["ZOE"], ["Civic"]). ["ALL"] = any model. pub models: &'static [&'static str], pub region: &'static str, pub description: &'static str, + /// Source URL (e.g. NVD detail page) for further reading. + pub url: &'static str, } -pub const VULN_DB: [VulnEntry; 2] = [ +pub const VULN_DB: [VulnEntry; 16] = [ VulnEntry { + id: 1, cve: "CVE-2022-38766", year_start: "2020", year_end: "2022", @@ -27,8 +36,10 @@ pub const VULN_DB: [VulnEntry; 2] = [ models: &["ZOE"], region: "ALL", description: "The remote keyless system on Renault ZOE 2021 vehicles sends 433.92 MHz RF signals from the same Rolling Codes set for each door-open request, which allows for a replay attack.", + url: "https://nvd.nist.gov/vuln/detail/CVE-2022-38766", }, VulnEntry { + id: 2, cve: "CVE-2022-27254", year_start: "2016", year_end: "2019", @@ -36,6 +47,167 @@ pub const VULN_DB: [VulnEntry; 2] = [ models: &["Civic"], region: "ALL", description: "The remote keyless system on Honda Civic 2018 vehicles sends the same RF signal for each door-open request, which allows for a replay attack, a related issue to CVE-2019-20626.", + url: "https://nvd.nist.gov/vuln/detail/CVE-2022-27254", + }, + // CVE-2022-37418 (RollBack): per make/model/year from research table (RKE RollBack variant) + // Honda + VulnEntry { + id: 3, + cve: "CVE-2022-37418", + year_start: "2016", + year_end: "2018", + makes: &["Honda"], + models: &["Fit (hybrid)", "Fit Hybrid"], + region: "ALL", + description: "RKE RollBack: unlock/resync after capturing two consecutive key fob signals. Attacker can unlock indefinitely.", + url: "https://nvd.nist.gov/vuln/detail/CVE-2022-37418", + }, + VulnEntry { + id: 4, + cve: "CVE-2022-37418", + year_start: "2018", + year_end: "2018", + makes: &["Honda"], + models: &["Fit"], + region: "ALL", + description: "RKE RollBack: unlock/resync after capturing two consecutive key fob signals. Attacker can unlock indefinitely.", + url: "https://nvd.nist.gov/vuln/detail/CVE-2022-37418", + }, + VulnEntry { + id: 5, + cve: "CVE-2022-37418", + year_start: "2017", + year_end: "2017", + makes: &["Honda"], + models: &["City"], + region: "ALL", + description: "RKE RollBack: unlock/resync after capturing two consecutive key fob signals. Attacker can unlock indefinitely.", + url: "https://nvd.nist.gov/vuln/detail/CVE-2022-37418", + }, + VulnEntry { + id: 6, + cve: "CVE-2022-37418", + year_start: "2016", + year_end: "2022", + makes: &["Honda"], + models: &["Vezel"], + region: "ALL", + description: "RKE RollBack: unlock/resync after capturing two consecutive key fob signals. Attacker can unlock indefinitely.", + url: "https://nvd.nist.gov/vuln/detail/CVE-2022-37418", + }, + // Hyundai (Elantra 2013-2015 only; 2012 and Avante marked NO in table) + VulnEntry { + id: 7, + cve: "CVE-2022-37418", + year_start: "2013", + year_end: "2015", + makes: &["Hyundai"], + models: &["Elantra"], + region: "ALL", + description: "RKE RollBack: unlock/resync after capturing two consecutive key fob signals. Attacker can unlock indefinitely.", + url: "https://nvd.nist.gov/vuln/detail/CVE-2022-37418", + }, + // Kia Cerato/Forte K3 (two year ranges in table) + VulnEntry { + id: 8, + cve: "CVE-2022-37418", + year_start: "2016", + year_end: "2018", + makes: &["Kia"], + models: &["Cerato", "Forte", "K3"], + region: "ALL", + description: "RKE RollBack: unlock/resync after capturing two consecutive key fob signals. Attacker can unlock indefinitely.", + url: "https://nvd.nist.gov/vuln/detail/CVE-2022-37418", + }, + VulnEntry { + id: 9, + cve: "CVE-2022-37418", + year_start: "2012", + year_end: "2018", + makes: &["Kia"], + models: &["Cerato", "Forte", "K3"], + region: "ALL", + description: "RKE RollBack: unlock/resync after capturing two consecutive key fob signals. Attacker can unlock indefinitely.", + url: "https://nvd.nist.gov/vuln/detail/CVE-2022-37418", + }, + // Mazda — CVE-2022-36945 (RollBack with three consecutive signals; through 2020) + VulnEntry { + id: 10, + cve: "CVE-2022-36945", + year_start: "2018", + year_end: "2018", + makes: &["Mazda"], + models: &["3"], + region: "ALL", + description: "The RKE receiving unit on certain Mazda vehicles through 2020 allows remote attackers to perform unlock operations and force a resynchronization after capturing three consecutive valid key-fob signals over the radio, aka a RollBack attack. The attacker retains the ability to unlock indefinitely.", + url: "https://nvd.nist.gov/vuln/detail/CVE-2022-36945", + }, + VulnEntry { + id: 11, + cve: "CVE-2022-36945", + year_start: "2018", + year_end: "2018", + makes: &["Mazda"], + models: &["2 Sedan"], + region: "ALL", + description: "The RKE receiving unit on certain Mazda vehicles through 2020 allows remote attackers to perform unlock operations and force a resynchronization after capturing three consecutive valid key-fob signals over the radio, aka a RollBack attack. The attacker retains the ability to unlock indefinitely.", + url: "https://nvd.nist.gov/vuln/detail/CVE-2022-36945", + }, + VulnEntry { + id: 12, + cve: "CVE-2022-36945", + year_start: "2020", + year_end: "2020", + makes: &["Mazda"], + models: &["2 HB (facelift)", "2 HB"], + region: "ALL", + description: "The RKE receiving unit on certain Mazda vehicles through 2020 allows remote attackers to perform unlock operations and force a resynchronization after capturing three consecutive valid key-fob signals over the radio, aka a RollBack attack. The attacker retains the ability to unlock indefinitely.", + url: "https://nvd.nist.gov/vuln/detail/CVE-2022-36945", + }, + VulnEntry { + id: 13, + cve: "CVE-2022-36945", + year_start: "2019", + year_end: "2019", + makes: &["Mazda"], + models: &["Cx-3", "CX-3"], + region: "ALL", + description: "The RKE receiving unit on certain Mazda vehicles through 2020 allows remote attackers to perform unlock operations and force a resynchronization after capturing three consecutive valid key-fob signals over the radio, aka a RollBack attack. The attacker retains the ability to unlock indefinitely.", + url: "https://nvd.nist.gov/vuln/detail/CVE-2022-36945", + }, + VulnEntry { + id: 14, + cve: "CVE-2022-36945", + year_start: "2018", + year_end: "2018", + makes: &["Mazda"], + models: &["Cx-5", "CX-5"], + region: "ALL", + description: "The RKE receiving unit on certain Mazda vehicles through 2020 allows remote attackers to perform unlock operations and force a resynchronization after capturing three consecutive valid key-fob signals over the radio, aka a RollBack attack. The attacker retains the ability to unlock indefinitely.", + url: "https://nvd.nist.gov/vuln/detail/CVE-2022-36945", + }, + // Nissan (Latio, Sylphy; Teana and Wish marked NO in table — excluded) + VulnEntry { + id: 15, + cve: "CVE-2022-37418", + year_start: "2007", + year_end: "2012", + makes: &["Nissan"], + models: &["Latio"], + region: "ALL", + description: "RKE RollBack: unlock/resync after capturing two consecutive key fob signals. Attacker can unlock indefinitely.", + url: "https://nvd.nist.gov/vuln/detail/CVE-2022-37418", + }, + VulnEntry { + id: 16, + cve: "CVE-2022-37418", + year_start: "2012", + year_end: "2019", + makes: &["Nissan"], + models: &["Sylphy"], + region: "ALL", + description: "RKE RollBack: unlock/resync after capturing two consecutive key fob signals. Attacker can unlock indefinitely.", + url: "https://nvd.nist.gov/vuln/detail/CVE-2022-37418", }, ];