Alex Plaskett and Robert Herrera presented “Exploiting USB on a Tesla IVI with Raspberry Pi Devices to bypass KASLR“ on the at Insomnihack Switerzerland 2026.
Video
Slides
Abstract
The abstract for the talk presented was as follows:
Abstract:
In late 2024 a USB vulnerability (CVE-2024-53150) was reported by Google Threat Analysis Group to the Linux Kernel mailing list and was subsequently added to CISA known exploited vulnerabilities (KEV) list.
Then in early 2025, multiple other Linux Kernel USB vulnerabilities were found to have been exploited to compromise mobile phone devices in the wild (as covered by Amnesty International).
Whilst the vulnerabilities themselves have been described previously, a method of practically exploiting these issues along with ease of exploitation was not known.
NCC’s Exploit Development Group decided to answer the question - what does it take to exploit Linux Kernel USB vulnerabilities such as these against a modern Linux version?
This also led to our first discovery, which was that these USB vulnerabilities affected more than just mobile devices. Tesla’s automotive, in-vehicle infotainment (IVI) system was also vulnerable to a number of these core Linux kernel issues!
This talk is specifically about exploiting one of these vulnerabilities (CVE-2024-53150) and the novel tooling it was necessary to develop to bypass KASLR on a Tesla IVI.
Description:
In this talk we will first describe one of these issues CVE-2024-53150 - an out of bounds read when finding clock sources in USB audio.
The vulnerability was in the usb/sound subsystem of the Linux Kernel and, at the time of its initial discovery, was present on Tesla's IVI Software version 2025.20.3 which was running Linux Kernel Version 5.4.284.
Our method of exploitation for this issue will be described. This requires connecting multiple different arbitrary USB devices used for different USB exploitation tasks (such as heap spraying) and controlling malicious USB data.
Specifically, this vulnerability was exploited by connecting a malicious USB device that first connects arbitrary USB devices that spray kernel heap memory chunks that contain a pointer in the adjacent heap chunk.
Next, we exploited the information disclosure vulnerability by sending specially crafted USB Audio descriptors that cause the Host OS to leak this adjacent kernel memory pointer back to the malicious USB device via a USB control message.
This leaked data allowed us to create a KASLR bypass primitive.
We achieved this by using numerous techniques for data extraction and creating a Python and C based USB exploit framework called DUET (Dynamic USB Exploitation Tool). This tool is based on Raspberry Pi Pico’s with Wi-Fi coordination and control and physical USB hubs.
We will also talk about some of the advantages and challenges we faced with the development of this framework and describe improvements which could be made to enhance USB exploitation.