Path Traversal Flaw in Renault TomTom Carminat LIVE Navigation Unit Enables Root Code Execution via Malicious SD Card
Security researcher Rasmus Moorats disclosed a path traversal vulnerability in the TomTom Carminat LIVE navigation unit used in some Renault vehicles (codenamed "beaumont"), including a 2014 Renault Latitude. The unit runs a custom OS based on the outdated Linux 2.6.28.10 kernel on a Samsung S5P6440 chip, and processes a master.script file from an SD card at boot after a user confirms an on-screen prompt. By chaining an unsanitized LOG command path traversal with the SHEX command, the researcher achieved root code execution despite read-only and noexec partition protections, by abusing the Linux core_pattern crash-handler mechanism to run an attacker-controlled script as root. Exploitation requires physical access to the vehicle and user interaction to accept the script execution prompt, making remote or mass exploitation unlikely, but a tampered SD card provided during valet or repair service, or via social engineering, is a realistic risk.
Entenda a falha
A vulnerabilidade
A path traversal flaw in the master.script parser (ttn) of the TomTom Carminat LIVE navigation unit (codename beaumont, used in some Renault cars such as the 2014 Latitude) leads to root code execution. The unit runs a custom TomTom OS on Linux 2.6.28.10 with a Samsung S5P6440 chip. The attacker needs physical access to insert a malicious SD card, and the user must press Yes at the 'Execute master.script?' prompt at boot. The result is code running as root. No CVE, affected version list or vendor fix is given in the article.
Como funciona
At every boot the unit looks for a master.script file on the SD card and, after the user confirms the prompt, the ttn program, which runs as root, interprets it in a custom automation language. The LOG command writes one line of printable text to a file named by the script, and SHEX runs a program already present on the device without arguments. Because LOG does not validate the path, the write can escape the intended log folder and reach any location, including the kernel crash-handler setting. A program then crashes on purpose, and the kernel runs the configured handler as root, which reads the script from the SD card as data. This works despite the read-only root filesystem and the noexec mounts.
Por que é vulnerável
The root cause is a missing path sanitization in the LOG command of a parser that runs with root privileges, so ../ sequences are accepted. On its own the flaw looked harmless, because the root filesystem is read-only and the SD card is mounted noexec. It became serious because a root-run parser can write to /proc/sys/kernel/core_pattern, and because the old Linux 2.6.28.10 kernel lacks many modern mitigations. The noexec flag does not stop a shell already on an executable partition from reading a script as data. The article mentions no fix.
Onde está
The articles name the ttn parser of master.script, specifically the LOG and SHEX commands, but give no public file, function or commit.
Como foi descoberta
Security researcher Rasmus Moorats found the flaw while trying to fix the clock on his 2014 Renault Latitude, which led him to study the head unit. He published his findings on November 2, 2026. The articles do not mention a report to TomTom or Renault, coordinated disclosure or any vendor response.
PoC pública
Moorats published a working exploit as part of his write-up, as described by GBHackers. It is only three lines of script: a directive redirecting the LOG output, a LOG line, and a SHEX call to /bin/dbus-monitor. The first proof of concept simply rebooted the unit; he then used root to back up the internal eMMC with dd and to edit settings.dat to change the timezone. It is a functional exploit, but it needs physical access and user confirmation, so urgency is low for most owners and higher for valet or repair scenarios.
Publicada em: gbhackers.com/renault-navigation-system/ ↗
Explicação gerada por IA a partir da matéria e dos artigos, em 03/11/2026 11:16.
Detalhes técnicos
The ttn parser running as root handles two custom automation commands: LOG, which writes printable text to a file without sanitizing the path (allowing ../ traversal), and SHEX, which executes an existing on-device binary without argument passing. The researcher used the LOG flaw to write into /proc/sys/kernel/core_pattern, setting it to pipe crash data to /bin/sh /media/sdcard/payload.sh. Since /bin/sh resides on an executable partition, the noexec restriction on the SD card was bypassed. The SHEX command then launched /bin/dbus-monitor, which crashes without a system bus, triggering the kernel to execute the attacker's script as root. The full exploit required only three lines of script. The researcher confirmed root access by rebooting the unit, backing up the internal eMMC with dd, and modifying settings.dat to change the timezone.
Remediação
No official vendor fix or advisory is mentioned in the article. Risk mitigation should focus on controlling physical access to vehicles and SD cards used in these navigation units, particularly during valet parking or third-party repair/service.
Linha do tempo
-
Path Traversal Flaw in Renault TomTom Carminat LIVE Navigation Unit Enables Root Code Execution via Malicious SD Card
ler a análise desta fonte ocultar
Security researcher Rasmus Moorats disclosed a path traversal vulnerability in the TomTom Carminat LIVE navigation unit used in some Renault vehicles (codenamed "beaumont"), including a 2014 Renault Latitude. The unit runs a custom OS based on the outdated Linux 2.6.28.10 kernel on a Samsung S5P6440 chip, and processes a
master.scriptfile from an SD card at boot after a user confirms an on-screen prompt. By chaining an unsanitizedLOGcommand path traversal with theSHEXcommand, the researcher achieved root code execution despite read-only and noexec partition protections, by abusing the Linuxcore_patterncrash-handler mechanism to run an attacker-controlled script as root. Exploitation requires physical access to the vehicle and user interaction to accept the script execution prompt, making remote or mass exploitation unlikely, but a tampered SD card provided during valet or repair service, or via social engineering, is a realistic risk.Technical Details
The
ttnparser running as root handles two custom automation commands:LOG, which writes printable text to a file without sanitizing the path (allowing../traversal), andSHEX, which executes an existing on-device binary without argument passing. The researcher used theLOGflaw to write into/proc/sys/kernel/core_pattern, setting it to pipe crash data to/bin/sh /media/sdcard/payload.sh. Since/bin/shresides on an executable partition, the noexec restriction on the SD card was bypassed. TheSHEXcommand then launched/bin/dbus-monitor, which crashes without a system bus, triggering the kernel to execute the attacker's script as root. The full exploit required only three lines of script. The researcher confirmed root access by rebooting the unit, backing up the internal eMMC withdd, and modifyingsettings.datto change the timezone.Remediation
No official vendor fix or advisory is mentioned in the article. Risk mitigation should focus on controlling physical access to vehicles and SD cards used in these navigation units, particularly during valet parking or third-party repair/service.