# Communication-Traffic-Assisted Mining and Exploitation of Buffer Overflow Vulnerabilities in ADASs
### Related Work  
It is known that BOF attacks have been causing serious security problems for decades; over 50 percent of today's widely exploited vulnerabilities are caused by BOF, and the ratio is increasing over time [8]. BOF-based attacks remain one of the most prevalent exploits to date, and as such, they are mostly an unsolved problem [9]. Due to the limited memory resources and generality of programming languages and operating systems, BOF poses unique risks to IoT devices. For example, a recent study evaluated the vulnerability to BOF attacks on operating systems in IoT, precisely executing the application on FreeRTOS and analyzing multiple attack methods [9]. This is because IoT devices typically do not choose substantial capacity memories to save power. However, the smaller the buffer, the easier it is to overflow. In addition, most programs used for IoT are written in C or C++, neither of which has a \"garbage collection mechanism\" to meet extra memory requirements, which also increases the risk of BOF vulnerabilities. At the same time, these languages allow pointers, making it easier for hackers to determine the location of critical code in memory. For example, in 2018, researchers found a BOF vulnerability in the httpd component of Tenda routers, allowing attackers to conduct denial-of-service attacks by reverse-tracking the operation functions [10]. Moreover, IoT devices' operating systems and program dependency libraries are standard commercial products, and different manufacturers develop and maintain their codes. These code libraries may have vulnerabilities in different versions. Many embedded devices share the same operating system, application program libraries, and TCP/IP protocol stacks, and it could affect multiple devices if these shared components have vulnerabilities. For example, the chain of causes for Heartbleed is the input not being appropriately checked, which leads to too much data read--precisely, a massive number of bytes are read from the heap [11]. This affects many IoT devices using OpenSSL, which could lead to the leakage of sensitive information, such as private keys and user credentials. As a particular type of IoT device, the components of intelligent connected vehicles share many similarities with traditional IoT devices, such as the reuse of customized systems and dependent libraries and most software being written in C/C++. These characteristics determine the high probability that vulnerabilities exist in these components. Many research results from various institutions also prove this point. In 2021, Tencent's Keen Security Lab conducted cybersecurity research on the intelligent connectivity system of Mercedes-Benz cars [4]. They discovered five vulnerabilities in the Head Unit and Hermes, including a BOF vulnerability. In 2017, [PERSON] and two other researchers from McAfee announced at the Defcon 25 conference that they had found two separate BOF vulnerabilities in the remote information processing control units (TCUs) of Ford, BMW, Infiniti, and Nissan vehicles [12]. However, there remains a critical gap in the research on the mining and exploitation of BOF vulnerabilities in ADASs. Most academic research on ADASs focuses on the vulnerability of sensors and AI algorithms. For instance, [PERSON] et al. showed that projecting non-depth objects in front of ADASs' cameras can cause Tesla Model X and Mobileye 630 systems to misperceive them as physical obstacles, resulting in unexpected actions [1]. However, [PERSON] et al. 's LiDAR spoofing attack model put forward a potential safety threat to intelligent connected vehicles by tampering with the LiDAR system's input to the ADAS [2]. Thus, more research on vulnerability mining and exploitation for ADAS devices must be carried out. ADAS devices have richer storage and processing capabilities than traditional IoT devices, using closed-source and proprietary protocols for communication. These situations are more likely to lead to BOF vulnerabilities.