leviathan/KAT
1
1
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

CVE updates

Browse Source
This commit is contained in:
KaraZajac
2026-02-21 00:13:14 -05:00
parent da5950e872
commit 024b55a2a8
3 changed files with 194 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+13
View File
@@ -239,6 +239,19 @@ Protocol behavior and RF modulation (AM/FM) follow the ProtoPirate reference. KA
**KeeLoq generic fallback:** If no protocol decodes a capture, KAT tries KeeLoq with every keystore manufacturer key (Kia V3/V4 and Star Line bit layouts). On success the protocol is shown as **Keeloq (*keystore name*)** (e.g. Keeloq (Alligator), Keeloq (Pandora_PRO)). See [docs/keeloq_generic.md](docs/keeloq_generic.md).
### Vulnerability database
KAT matches capture metadata (Year / Make / Model / Region, set via **i** on a capture) against a built-in CVE list. The **Vuln Found** column and **Vulnerability** detail panel show matches; each CVE links to the NVD for further reading.
| CVE | Make(s) | Models | Year range | Description |
|-----|---------|--------|------------|-------------|
| [CVE-2022-38766](https://nvd.nist.gov/vuln/detail/CVE-2022-38766) | Renault | ZOE | 2020–2022 | Replay attack: same rolling code set per door-open request (433.92 MHz). |
| [CVE-2022-27254](https://nvd.nist.gov/vuln/detail/CVE-2022-27254) | Honda | Civic | 2016–2019 | Replay attack: same RF signal per door-open request (related to CVE-2019-20626). |
| [CVE-2022-37418](https://nvd.nist.gov/vuln/detail/CVE-2022-37418) | Honda, Hyundai, Kia, Nissan | Fit (hybrid), Fit, City, Vezel; Elantra; Cerato, Forte, K3; Latio, Sylphy | 2007–2022 (varies by model) | **RollBack attack:** RKE allows unlock and resync after capturing two consecutive key fob signals; attacker can unlock indefinitely. |
| [CVE-2022-36945](https://nvd.nist.gov/vuln/detail/CVE-2022-36945) | Mazda | 3, 2 Sedan, 2 HB (facelift), Cx-3, Cx-5 | 2018–2020 (varies by model) | **RollBack attack:** RKE allows unlock and resync after capturing **three** consecutive key fob signals; attacker can unlock indefinitely. |
Details (exact model/year scope) are in `src/vuln_db.rs`. The app shows the NVD URL for each matched CVE in the Vulnerability panel.
### Cryptographic modules
- **KeeLoq** — encrypt/decrypt with normal, secure, FAAC, and magic serial/XOR learning key derivation (keeloq_common, keys). Unknown signals are tried as KeeLoq with every keystore key via **keeloq_generic** (uses keeloq_common only).
src/ui/captures_list.rs
+4
View File
@@ -377,6 +377,10 @@ fn render_vulnerability_panel(
Span::styled(" Description: ", label_style),
Span::styled(v.description, value_style),
]));
lines.push(Line::from(vec![
Span::styled(" Source: ", label_style),
Span::styled(v.url, value_style),
]));
lines.push(Line::from(Span::raw("")));
}
}
src/vuln_db.rs
+177 -5
View File
@@ -1,25 +1,34 @@
//! Vulnerability database: CVE entries matched by year range, makes, models, region.
//! Used for "Vuln Found" column and the Vulnerability detail panel.
//!
//! Each row has a unique `id` so the same CVE can appear multiple times with different
//! year/make/model scope (e.g. per-model year ranges for CVE-2022-37418).
/// One CVE entry. Year range is inclusive; "ALL" for start/end means no bound.
/// Makes and models are arrays; any match counts. Use ["ALL"] to match any make/model.
/// One vulnerability scope: a single row in the DB. Uniquely identified by `id`.
/// The same CVE can appear in multiple entries with different year/make/model bounds.
#[derive(Debug, Clone)]
pub struct VulnEntry {
/// Unique id for this row (same CVE can have multiple rows with different scope). Used for tracking and future export/dedupe.
#[allow(dead_code)]
pub id: u32,
pub cve: &'static str,
/// Inclusive start year (e.g. "2018"). "ALL" = no lower bound.
pub year_start: &'static str,
/// Inclusive end year (e.g. "2021"). "ALL" = no upper bound.
pub year_end: &'static str,
/// Makes that are affected (e.g. ["Renault"], ["Honda", "Acura"]). ["ALL"] = any make.
/// Makes that are affected (e.g. ["Renault"]). ["ALL"] = any make.
pub makes: &'static [&'static str],
/// Models that are affected (e.g. ["ZOE"], ["Civic", "Accord"]). ["ALL"] = any model.
/// Models that are affected (e.g. ["ZOE"], ["Civic"]). ["ALL"] = any model.
pub models: &'static [&'static str],
pub region: &'static str,
pub description: &'static str,
/// Source URL (e.g. NVD detail page) for further reading.
pub url: &'static str,
}
pub const VULN_DB: [VulnEntry; 2] = [
pub const VULN_DB: [VulnEntry; 16] = [
VulnEntry {
id: 1,
cve: "CVE-2022-38766",
year_start: "2020",
year_end: "2022",
@@ -27,8 +36,10 @@ pub const VULN_DB: [VulnEntry; 2] = [
models: &["ZOE"],
region: "ALL",
description: "The remote keyless system on Renault ZOE 2021 vehicles sends 433.92 MHz RF signals from the same Rolling Codes set for each door-open request, which allows for a replay attack.",
url: "https://nvd.nist.gov/vuln/detail/CVE-2022-38766",
},
VulnEntry {
id: 2,
cve: "CVE-2022-27254",
year_start: "2016",
year_end: "2019",
@@ -36,6 +47,167 @@ pub const VULN_DB: [VulnEntry; 2] = [
models: &["Civic"],
region: "ALL",
description: "The remote keyless system on Honda Civic 2018 vehicles sends the same RF signal for each door-open request, which allows for a replay attack, a related issue to CVE-2019-20626.",
url: "https://nvd.nist.gov/vuln/detail/CVE-2022-27254",
},
// CVE-2022-37418 (RollBack): per make/model/year from research table (RKE RollBack variant)
// Honda
VulnEntry {
id: 3,
cve: "CVE-2022-37418",
year_start: "2016",
year_end: "2018",
makes: &["Honda"],
models: &["Fit (hybrid)", "Fit Hybrid"],
region: "ALL",
description: "RKE RollBack: unlock/resync after capturing two consecutive key fob signals. Attacker can unlock indefinitely.",
url: "https://nvd.nist.gov/vuln/detail/CVE-2022-37418",
},
VulnEntry {
id: 4,
cve: "CVE-2022-37418",
year_start: "2018",
year_end: "2018",
makes: &["Honda"],
models: &["Fit"],
region: "ALL",
description: "RKE RollBack: unlock/resync after capturing two consecutive key fob signals. Attacker can unlock indefinitely.",
url: "https://nvd.nist.gov/vuln/detail/CVE-2022-37418",
},
VulnEntry {
id: 5,
cve: "CVE-2022-37418",
year_start: "2017",
year_end: "2017",
makes: &["Honda"],
models: &["City"],
region: "ALL",
description: "RKE RollBack: unlock/resync after capturing two consecutive key fob signals. Attacker can unlock indefinitely.",
url: "https://nvd.nist.gov/vuln/detail/CVE-2022-37418",
},
VulnEntry {
id: 6,
cve: "CVE-2022-37418",
year_start: "2016",
year_end: "2022",
makes: &["Honda"],
models: &["Vezel"],
region: "ALL",
description: "RKE RollBack: unlock/resync after capturing two consecutive key fob signals. Attacker can unlock indefinitely.",
url: "https://nvd.nist.gov/vuln/detail/CVE-2022-37418",
},
// Hyundai (Elantra 2013-2015 only; 2012 and Avante marked NO in table)
VulnEntry {
id: 7,
cve: "CVE-2022-37418",
year_start: "2013",
year_end: "2015",
makes: &["Hyundai"],
models: &["Elantra"],
region: "ALL",
description: "RKE RollBack: unlock/resync after capturing two consecutive key fob signals. Attacker can unlock indefinitely.",
url: "https://nvd.nist.gov/vuln/detail/CVE-2022-37418",
},
// Kia Cerato/Forte K3 (two year ranges in table)
VulnEntry {
id: 8,
cve: "CVE-2022-37418",
year_start: "2016",
year_end: "2018",
makes: &["Kia"],
models: &["Cerato", "Forte", "K3"],
region: "ALL",
description: "RKE RollBack: unlock/resync after capturing two consecutive key fob signals. Attacker can unlock indefinitely.",
url: "https://nvd.nist.gov/vuln/detail/CVE-2022-37418",
},
VulnEntry {
id: 9,
cve: "CVE-2022-37418",
year_start: "2012",
year_end: "2018",
makes: &["Kia"],
models: &["Cerato", "Forte", "K3"],
region: "ALL",
description: "RKE RollBack: unlock/resync after capturing two consecutive key fob signals. Attacker can unlock indefinitely.",
url: "https://nvd.nist.gov/vuln/detail/CVE-2022-37418",
},
// Mazda — CVE-2022-36945 (RollBack with three consecutive signals; through 2020)
VulnEntry {
id: 10,
cve: "CVE-2022-36945",
year_start: "2018",
year_end: "2018",
makes: &["Mazda"],
models: &["3"],
region: "ALL",
description: "The RKE receiving unit on certain Mazda vehicles through 2020 allows remote attackers to perform unlock operations and force a resynchronization after capturing three consecutive valid key-fob signals over the radio, aka a RollBack attack. The attacker retains the ability to unlock indefinitely.",
url: "https://nvd.nist.gov/vuln/detail/CVE-2022-36945",
},
VulnEntry {
id: 11,
cve: "CVE-2022-36945",
year_start: "2018",
year_end: "2018",
makes: &["Mazda"],
models: &["2 Sedan"],
region: "ALL",
description: "The RKE receiving unit on certain Mazda vehicles through 2020 allows remote attackers to perform unlock operations and force a resynchronization after capturing three consecutive valid key-fob signals over the radio, aka a RollBack attack. The attacker retains the ability to unlock indefinitely.",
url: "https://nvd.nist.gov/vuln/detail/CVE-2022-36945",
},
VulnEntry {
id: 12,
cve: "CVE-2022-36945",
year_start: "2020",
year_end: "2020",
makes: &["Mazda"],
models: &["2 HB (facelift)", "2 HB"],
region: "ALL",
description: "The RKE receiving unit on certain Mazda vehicles through 2020 allows remote attackers to perform unlock operations and force a resynchronization after capturing three consecutive valid key-fob signals over the radio, aka a RollBack attack. The attacker retains the ability to unlock indefinitely.",
url: "https://nvd.nist.gov/vuln/detail/CVE-2022-36945",
},
VulnEntry {
id: 13,
cve: "CVE-2022-36945",
year_start: "2019",
year_end: "2019",
makes: &["Mazda"],
models: &["Cx-3", "CX-3"],
region: "ALL",
description: "The RKE receiving unit on certain Mazda vehicles through 2020 allows remote attackers to perform unlock operations and force a resynchronization after capturing three consecutive valid key-fob signals over the radio, aka a RollBack attack. The attacker retains the ability to unlock indefinitely.",
url: "https://nvd.nist.gov/vuln/detail/CVE-2022-36945",
},
VulnEntry {
id: 14,
cve: "CVE-2022-36945",
year_start: "2018",
year_end: "2018",
makes: &["Mazda"],
models: &["Cx-5", "CX-5"],
region: "ALL",
description: "The RKE receiving unit on certain Mazda vehicles through 2020 allows remote attackers to perform unlock operations and force a resynchronization after capturing three consecutive valid key-fob signals over the radio, aka a RollBack attack. The attacker retains the ability to unlock indefinitely.",
url: "https://nvd.nist.gov/vuln/detail/CVE-2022-36945",
},
// Nissan (Latio, Sylphy; Teana and Wish marked NO in table — excluded)
VulnEntry {
id: 15,
cve: "CVE-2022-37418",
year_start: "2007",
year_end: "2012",
makes: &["Nissan"],
models: &["Latio"],
region: "ALL",
description: "RKE RollBack: unlock/resync after capturing two consecutive key fob signals. Attacker can unlock indefinitely.",
url: "https://nvd.nist.gov/vuln/detail/CVE-2022-37418",
},
VulnEntry {
id: 16,
cve: "CVE-2022-37418",
year_start: "2012",
year_end: "2019",
makes: &["Nissan"],
models: &["Sylphy"],
region: "ALL",
description: "RKE RollBack: unlock/resync after capturing two consecutive key fob signals. Attacker can unlock indefinitely.",
url: "https://nvd.nist.gov/vuln/detail/CVE-2022-37418",
},
];