Monitoring Vulnerabilities in Next-Generation Automotive Operating Systems

arXiv:2607.07226 · cs.CR · Submitted 2026-07-08 · Read on arXiv

Dimitri Simon, Badis Hammi, Joaquin Garcia-Alfaro, Hervé Debar

cs.CR

Submitted: 2026-07-08

Journal ref: IEEE Internet of Things Journal,2026

DOI: 10.1109/JIOT.2026.3711962

Code: https://github.com/EternalDreamer01/vera

Project page: https://eclipse-score.github.io

License: http://creativecommons.org/licenses/by/4.0/

The gist: Software-defined vehicles (SDVs) are revolutionizing transportation by integrating complex, interconnected hardware, and software systems.

Terminology

Core — 15× in this paper · explained in 2 episodes
Software-Defined Vehicle — 8× in this paper
Local Privilege Escalation — 4× in this paper
APEX — 3× in this paper · explained in 1 episode
Automotive Grade Linux — 3× in this paper
Benchmark — 3× in this paper · explained in 2 episodes
CVE Binary Tool — 3× in this paper
Remote Code Execution — 3× in this paper
Abstraction — 2× in this paper · explained in 1 episode
Common Vulnerabilities and Exposures — 2× in this paper
Open Container Initiative — 2× in this paper
Steering — 2× in this paper · explained in 2 episodes
Verification — 2× in this paper · explained in 2 episodes
Advanced Driver-Assistance Systems — 1× in this paper
Android Debug Bridge — 1× in this paper
Common Platform Enumeration — 1× in this paper
Common Vulnerability Scoring System — 1× in this paper
Consistency — 1× in this paper · explained in 3 episodes
Cybersecurity Assurance Level — 1× in this paper
Electronic Control Units — 1× in this paper
Exploit Prediction Scoring System — 1× in this paper
Failure Modes — 1× in this paper · explained in 3 episodes
Fidelity — 1× in this paper · explained in 2 episodes
High Performance Computer — 1× in this paper
Modularity — 1× in this paper · explained in 9 episodes
Original Equipment Manufacturer — 1× in this paper
Over The Air — 1× in this paper
Provenance — 1× in this paper · explained in 4 episodes
Real-Time Operating Systems — 1× in this paper
Robustness — 1× in this paper · explained in 5 episodes
Threat Analysis and Risk Assessment — 1× in this paper
Trace — 1× in this paper · explained in 2 episodes
US National Vulnerability Database — 1× in this paper

Abstract

Software-defined vehicles (SDVs) are revolutionizing transportation by integrating complex, interconnected hardware, and software systems. This evolution introduces significant security challenges. We present a comprehensive security analysis for SDVs, focusing on software vulnerabilities. We note that existing vulnerability assessment tools fall short in addressing operating systems vulnerabilities, particularly when it comes to efficiently analyzing diverse software stacks in realistic environments. We present and release a vulnerability assessment solution that efficiently addresses these limitations. Our approach combines systematic vulnerability discovery, leveraging public Common Vulnerabilities and Exposures (CVE) databases, within a dockerized development environment that evaluates exploitability risks. The results reveal both breadth of potential threats and the practical constraints we faced during exploitation. We discuss the implications for industry and research, and propose directions for building more resilient SDVs.

Monitoring Vulnerabilities in Next-Generation Automotive Operating Systems

Terminology

Abstract

Sources

Related papers