CVE updates

README.md

@@ -239,6 +239,19 @@ Protocol behavior and RF modulation (AM/FM) follow the ProtoPirate reference. KA
 
 **KeeLoq generic fallback:** If no protocol decodes a capture, KAT tries KeeLoq with every keystore manufacturer key (Kia V3/V4 and Star Line bit layouts). On success the protocol is shown as **Keeloq (*keystore name*)** (e.g. Keeloq (Alligator), Keeloq (Pandora_PRO)). See [docs/keeloq_generic.md](docs/keeloq_generic.md).
 
+### Vulnerability database
+
+KAT matches capture metadata (Year / Make / Model / Region, set via **i** on a capture) against a built-in CVE list. The **Vuln Found** column and **Vulnerability** detail panel show matches; each CVE links to the NVD for further reading.
+
+| CVE | Make(s) | Models | Year range | Description |
+|-----|---------|--------|------------|-------------|
+| [CVE-2022-38766](https://nvd.nist.gov/vuln/detail/CVE-2022-38766) | Renault | ZOE | 2020–2022 | Replay attack: same rolling code set per door-open request (433.92 MHz). |
+| [CVE-2022-27254](https://nvd.nist.gov/vuln/detail/CVE-2022-27254) | Honda | Civic | 2016–2019 | Replay attack: same RF signal per door-open request (related to CVE-2019-20626). |
+| [CVE-2022-37418](https://nvd.nist.gov/vuln/detail/CVE-2022-37418) | Honda, Hyundai, Kia, Nissan | Fit (hybrid), Fit, City, Vezel; Elantra; Cerato, Forte, K3; Latio, Sylphy | 2007–2022 (varies by model) | **RollBack attack:** RKE allows unlock and resync after capturing two consecutive key fob signals; attacker can unlock indefinitely. |
+| [CVE-2022-36945](https://nvd.nist.gov/vuln/detail/CVE-2022-36945) | Mazda | 3, 2 Sedan, 2 HB (facelift), Cx-3, Cx-5 | 2018–2020 (varies by model) | **RollBack attack:** RKE allows unlock and resync after capturing **three** consecutive key fob signals; attacker can unlock indefinitely. |
+
+Details (exact model/year scope) are in `src/vuln_db.rs`. The app shows the NVD URL for each matched CVE in the Vulnerability panel.
+
 ### Cryptographic modules
 
 - **KeeLoq** — encrypt/decrypt with normal, secure, FAAC, and magic serial/XOR learning key derivation (keeloq_common, keys). Unknown signals are tried as KeeLoq with every keystore key via **keeloq_generic** (uses keeloq_common only).

src/ui/captures_list.rs

@@ -377,6 +377,10 @@ fn render_vulnerability_panel(
                 Span::styled(" Description: ", label_style),
                 Span::styled(v.description, value_style),
             ]));
+            lines.push(Line::from(vec![
+                Span::styled(" Source: ", label_style),
+                Span::styled(v.url, value_style),
+            ]));
             lines.push(Line::from(Span::raw("")));
         }
     }

src/vuln_db.rs

@@ -1,25 +1,34 @@
 //! Vulnerability database: CVE entries matched by year range, makes, models, region.
 //! Used for "Vuln Found" column and the Vulnerability detail panel.
+//!
+//! Each row has a unique `id` so the same CVE can appear multiple times with different
+//! year/make/model scope (e.g. per-model year ranges for CVE-2022-37418).
 
-/// One CVE entry. Year range is inclusive; "ALL" for start/end means no bound.
+/// One vulnerability scope: a single row in the DB. Uniquely identified by `id`.
-/// Makes and models are arrays; any match counts. Use ["ALL"] to match any make/model.
+/// The same CVE can appear in multiple entries with different year/make/model bounds.
 #[derive(Debug, Clone)]
 pub struct VulnEntry {
+    /// Unique id for this row (same CVE can have multiple rows with different scope). Used for tracking and future export/dedupe.
+    #[allow(dead_code)]
+    pub id: u32,
     pub cve: &'static str,
     /// Inclusive start year (e.g. "2018"). "ALL" = no lower bound.
     pub year_start: &'static str,
     /// Inclusive end year (e.g. "2021"). "ALL" = no upper bound.
     pub year_end: &'static str,
-    /// Makes that are affected (e.g. ["Renault"], ["Honda", "Acura"]). ["ALL"] = any make.
+    /// Makes that are affected (e.g. ["Renault"]). ["ALL"] = any make.
     pub makes: &'static [&'static str],
-    /// Models that are affected (e.g. ["ZOE"], ["Civic", "Accord"]). ["ALL"] = any model.
+    /// Models that are affected (e.g. ["ZOE"], ["Civic"]). ["ALL"] = any model.
     pub models: &'static [&'static str],
     pub region: &'static str,
     pub description: &'static str,
+    /// Source URL (e.g. NVD detail page) for further reading.
+    pub url: &'static str,
 }
 
-pub const VULN_DB: [VulnEntry; 2] = [
+pub const VULN_DB: [VulnEntry; 16] = [
     VulnEntry {
+        id: 1,
         cve: "CVE-2022-38766",
         year_start: "2020",
         year_end: "2022",
@@ -27,8 +36,10 @@ pub const VULN_DB: [VulnEntry; 2] = [
         models: &["ZOE"],
         region: "ALL",
         description: "The remote keyless system on Renault ZOE 2021 vehicles sends 433.92 MHz RF signals from the same Rolling Codes set for each door-open request, which allows for a replay attack.",
+        url: "https://nvd.nist.gov/vuln/detail/CVE-2022-38766",
     },
     VulnEntry {
+        id: 2,
         cve: "CVE-2022-27254",
         year_start: "2016",
         year_end: "2019",
@@ -36,6 +47,167 @@ pub const VULN_DB: [VulnEntry; 2] = [
         models: &["Civic"],
         region: "ALL",
         description: "The remote keyless system on Honda Civic 2018 vehicles sends the same RF signal for each door-open request, which allows for a replay attack, a related issue to CVE-2019-20626.",
+        url: "https://nvd.nist.gov/vuln/detail/CVE-2022-27254",
+    },
+    // CVE-2022-37418 (RollBack): per make/model/year from research table (RKE RollBack variant)
+    // Honda
+    VulnEntry {
+        id: 3,
+        cve: "CVE-2022-37418",
+        year_start: "2016",
+        year_end: "2018",
+        makes: &["Honda"],
+        models: &["Fit (hybrid)", "Fit Hybrid"],
+        region: "ALL",
+        description: "RKE RollBack: unlock/resync after capturing two consecutive key fob signals. Attacker can unlock indefinitely.",
+        url: "https://nvd.nist.gov/vuln/detail/CVE-2022-37418",
+    },
+    VulnEntry {
+        id: 4,
+        cve: "CVE-2022-37418",
+        year_start: "2018",
+        year_end: "2018",
+        makes: &["Honda"],
+        models: &["Fit"],
+        region: "ALL",
+        description: "RKE RollBack: unlock/resync after capturing two consecutive key fob signals. Attacker can unlock indefinitely.",
+        url: "https://nvd.nist.gov/vuln/detail/CVE-2022-37418",
+    },
+    VulnEntry {
+        id: 5,
+        cve: "CVE-2022-37418",
+        year_start: "2017",
+        year_end: "2017",
+        makes: &["Honda"],
+        models: &["City"],
+        region: "ALL",
+        description: "RKE RollBack: unlock/resync after capturing two consecutive key fob signals. Attacker can unlock indefinitely.",
+        url: "https://nvd.nist.gov/vuln/detail/CVE-2022-37418",
+    },
+    VulnEntry {
+        id: 6,
+        cve: "CVE-2022-37418",
+        year_start: "2016",
+        year_end: "2022",
+        makes: &["Honda"],
+        models: &["Vezel"],
+        region: "ALL",
+        description: "RKE RollBack: unlock/resync after capturing two consecutive key fob signals. Attacker can unlock indefinitely.",
+        url: "https://nvd.nist.gov/vuln/detail/CVE-2022-37418",
+    },
+    // Hyundai (Elantra 2013-2015 only; 2012 and Avante marked NO in table)
+    VulnEntry {
+        id: 7,
+        cve: "CVE-2022-37418",
+        year_start: "2013",
+        year_end: "2015",
+        makes: &["Hyundai"],
+        models: &["Elantra"],
+        region: "ALL",
+        description: "RKE RollBack: unlock/resync after capturing two consecutive key fob signals. Attacker can unlock indefinitely.",
+        url: "https://nvd.nist.gov/vuln/detail/CVE-2022-37418",
+    },
+    // Kia Cerato/Forte K3 (two year ranges in table)
+    VulnEntry {
+        id: 8,
+        cve: "CVE-2022-37418",
+        year_start: "2016",
+        year_end: "2018",
+        makes: &["Kia"],
+        models: &["Cerato", "Forte", "K3"],
+        region: "ALL",
+        description: "RKE RollBack: unlock/resync after capturing two consecutive key fob signals. Attacker can unlock indefinitely.",
+        url: "https://nvd.nist.gov/vuln/detail/CVE-2022-37418",
+    },
+    VulnEntry {
+        id: 9,
+        cve: "CVE-2022-37418",
+        year_start: "2012",
+        year_end: "2018",
+        makes: &["Kia"],
+        models: &["Cerato", "Forte", "K3"],
+        region: "ALL",
+        description: "RKE RollBack: unlock/resync after capturing two consecutive key fob signals. Attacker can unlock indefinitely.",
+        url: "https://nvd.nist.gov/vuln/detail/CVE-2022-37418",
+    },
+    // Mazda — CVE-2022-36945 (RollBack with three consecutive signals; through 2020)
+    VulnEntry {
+        id: 10,
+        cve: "CVE-2022-36945",
+        year_start: "2018",
+        year_end: "2018",
+        makes: &["Mazda"],
+        models: &["3"],
+        region: "ALL",
+        description: "The RKE receiving unit on certain Mazda vehicles through 2020 allows remote attackers to perform unlock operations and force a resynchronization after capturing three consecutive valid key-fob signals over the radio, aka a RollBack attack. The attacker retains the ability to unlock indefinitely.",
+        url: "https://nvd.nist.gov/vuln/detail/CVE-2022-36945",
+    },
+    VulnEntry {
+        id: 11,
+        cve: "CVE-2022-36945",
+        year_start: "2018",
+        year_end: "2018",
+        makes: &["Mazda"],
+        models: &["2 Sedan"],
+        region: "ALL",
+        description: "The RKE receiving unit on certain Mazda vehicles through 2020 allows remote attackers to perform unlock operations and force a resynchronization after capturing three consecutive valid key-fob signals over the radio, aka a RollBack attack. The attacker retains the ability to unlock indefinitely.",
+        url: "https://nvd.nist.gov/vuln/detail/CVE-2022-36945",
+    },
+    VulnEntry {
+        id: 12,
+        cve: "CVE-2022-36945",
+        year_start: "2020",
+        year_end: "2020",
+        makes: &["Mazda"],
+        models: &["2 HB (facelift)", "2 HB"],
+        region: "ALL",
+        description: "The RKE receiving unit on certain Mazda vehicles through 2020 allows remote attackers to perform unlock operations and force a resynchronization after capturing three consecutive valid key-fob signals over the radio, aka a RollBack attack. The attacker retains the ability to unlock indefinitely.",
+        url: "https://nvd.nist.gov/vuln/detail/CVE-2022-36945",
+    },
+    VulnEntry {
+        id: 13,
+        cve: "CVE-2022-36945",
+        year_start: "2019",
+        year_end: "2019",
+        makes: &["Mazda"],
+        models: &["Cx-3", "CX-3"],
+        region: "ALL",
+        description: "The RKE receiving unit on certain Mazda vehicles through 2020 allows remote attackers to perform unlock operations and force a resynchronization after capturing three consecutive valid key-fob signals over the radio, aka a RollBack attack. The attacker retains the ability to unlock indefinitely.",
+        url: "https://nvd.nist.gov/vuln/detail/CVE-2022-36945",
+    },
+    VulnEntry {
+        id: 14,
+        cve: "CVE-2022-36945",
+        year_start: "2018",
+        year_end: "2018",
+        makes: &["Mazda"],
+        models: &["Cx-5", "CX-5"],
+        region: "ALL",
+        description: "The RKE receiving unit on certain Mazda vehicles through 2020 allows remote attackers to perform unlock operations and force a resynchronization after capturing three consecutive valid key-fob signals over the radio, aka a RollBack attack. The attacker retains the ability to unlock indefinitely.",
+        url: "https://nvd.nist.gov/vuln/detail/CVE-2022-36945",
+    },
+    // Nissan (Latio, Sylphy; Teana and Wish marked NO in table — excluded)
+    VulnEntry {
+        id: 15,
+        cve: "CVE-2022-37418",
+        year_start: "2007",
+        year_end: "2012",
+        makes: &["Nissan"],
+        models: &["Latio"],
+        region: "ALL",
+        description: "RKE RollBack: unlock/resync after capturing two consecutive key fob signals. Attacker can unlock indefinitely.",
+        url: "https://nvd.nist.gov/vuln/detail/CVE-2022-37418",
+    },
+    VulnEntry {
+        id: 16,
+        cve: "CVE-2022-37418",
+        year_start: "2012",
+        year_end: "2019",
+        makes: &["Nissan"],
+        models: &["Sylphy"],
+        region: "ALL",
+        description: "RKE RollBack: unlock/resync after capturing two consecutive key fob signals. Attacker can unlock indefinitely.",
+        url: "https://nvd.nist.gov/vuln/detail/CVE-2022-37418",
     },
 ];