Mercedes-Benz cars are often seen as luxury vehicles packed with the latest tech. But, like any high-tech device, they can also have security holes. Today, let’s look closely at CVE-2023-34398, a vulnerability found in the NTG6 head-unit system, often used in new Mercedes cars. We’ll break down what the bug is, how it works, and what it means for car owners and researchers.

TL;DR:
A bug in the Boost C++ library’s serialization archive handling can let an attacker crash the head-unit or possibly execute code by plugging in an evil USB stick with crafted profiles.

What is CVE-2023-34398?

NTG6 is Mercedes’ infotainment (head-unit) system, which controls navigation, music, and even car settings. To make switching cars and repairing devices easier, Mercedes lets users import and export “profile settings” via USB. These profiles are stored and loaded using serialized archives — basically, files that contain all your settings.

The Mercedes code uses the Boost C++ serialization library to load and save these archives. But, as it turns out, Boost contains a critical vulnerability that allows a null pointer dereference under specific, but possible, circumstances.

The Vulnerability: Null Pointer Dereference in Boost Serialization

The Boost Serialization library lets you turn C++ objects into archives, and vice versa. But in some cases, bad data in the archive can cause the library to try to use a pointer that is actually NULL (a “null pointer”), which leads to a crash.

A malicious attacker who knows the system well can craft a profile file that, when imported over USB into the head-unit, triggers this bug. In the NTG6 context, this will at best crash the infotainment system, forcing a restart. In a more advanced scenario, it could be used in a chain to achieve remote code execution (RCE).

Official advisory:
- MITRE CVE-2023-34398

Exploiting NTG6 Profile Imports

Let's see an example of how this exploit might work in a real-world scenario.

### 1. User Option: Import/Export Over USB

Inside the Mercedes NTG6 UI, in the “Profiles” section, you will find options to import settings from a USB stick. This is handy for sharing preferences or resetting the system — but also creates a vector for attack.

2. Profile Archive Format

The profile files are actually *serialized Boost archives*. If an attacker can generate their own Boost archive (or edit one), and set some fields to strange or unexpected values, they may trigger the bug.

The bug occurs if a certain expected object isn’t defined or is given a null value, leading to a null pointer dereference when deserializing the profile.

3. Proof-of-Concept: How a Malicious Archive Might Look

Here’s a minimalistic example using C++ and Boost. (For research purposes only!)

#include <boost/archive/text_oarchive.hpp>
#include <fstream>

struct DangerousProfile {
    int settings_id;
    // pointer field to simulate missing data
    char* dangerous_field = nullptr; 
};

int main() {
    std::ofstream file("exploit_profile.bin");
    boost::archive::text_oarchive oa(file);
    DangerousProfile p;
    // Don't set dangerous_field; it stays NULL
    oa << p;
    return ;
}

This creates a profile file where the dangerous_field is NULL. A normal import into NTG6 might treat this with a *null pointer dereference*, crashing the system. A real attacker would go much further — fuzzing different field values to achieve controlled memory corruption.

Note: For safety, do not test with a real Mercedes vehicle — you could brick or destabilize your own device!

4. Real-World Impact

- For Drivers: The risk is mainly with physical access. Someone would need to plug in a bad USB stick to trigger this.
- For Developers/Researchers: This shows the danger of trusting imported profile data and relying on libraries not meant to handle untrusted input.
- For Mercedes: Depending on firmware version, this could allow for denial-of-service and possibly deeper attacks.

Mitigation

- Update: Mercedes has issued patches for affected head-units. Always keep your head-unit software updated.
- Don’t Import Profiles From Unknown Sources: Only import or export profiles on trusted USB drives.
- For Developers: Don’t trust input, even between official features. Add checks so that null pointers in deserialization don't crash your app.

Further Reading and References

- CVE-2023-34398 at MITRE
- Boost Serialization Documentation
- MBUX User Manual - Mercedes-Benz

Conclusion

CVE-2023-34398 is a reminder that every USB import/export feature can be a security risk — even in luxury cars. As our vehicles become more like rolling computers, both users and manufacturers need to be aware of bugs lurking deep in their supply chains, such as in third-party libraries like Boost.

Don’t trust every USB stick, and keep your car software up-to-date!


*This post is for educational purposes only. Do not attempt unauthorized access or modification of any vehicle system. Always follow applicable laws and guidelines.*

Timeline

Published on: 02/13/2025 22:15:10 UTC
Last modified on: 03/18/2025 18:15:26 UTC