A heap buffer over-read vulnerability in the Automotive Grade Linux agl-service-can-low-level service poses a risk of unauthorized information disclosure.

The vulnerability exists in the isotp_continue_receive function of the isotp-c library, where a heap buffer over-read occurs due to insufficient validation of the payload length nibble in CAN frames. An unauthenticated attacker positioned on the local CAN network can trigger this read by sending a malformed frame that causes the application to copy data beyond the allocated buffer boundaries.

Successful exploitation of this flaw may lead to the disclosure of sensitive memory contents, potentially exposing cryptographic keys or other protected data processed by the vehicle service. Given the CVSS score of 7.1, this is a high-severity issue that could compromise the integrity and confidentiality of automotive communication systems. While the attack requires access to the local area network, the potential for arbitrary memory reading represents a significant security failure in vehicle component software.

Immediate Action: Monitor the Automotive Grade Linux gerrit repository for the release of an official patch or updated library version and apply it to all affected deployments immediately.

Proactive Monitoring: Inspect system logs and network traffic for malformed CAN frames or unexpected service crashes that may indicate an attempt to exploit the isotp-c buffer over-read.

Compensating Controls: Implement strict input validation and frame size filtering at the hardware or gateway level to prevent malformed CAN frames from reaching the vulnerable service.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the technical write-up referenced by the researcher.

This vulnerability presents a clear risk to the security of automotive communication protocols by allowing unauthorized memory access. Organizations utilizing Automotive Grade Linux should prioritize the identification of affected systems within their fleet and verify the status of the isotp-c library updates. Immediate action is required to patch the library once the vendor releases the fix to ensure the confidentiality of system memory.