Materials of the bus.
Weaknesses in the stack.
This is a plant wall for code, not a chat bot. It reads the open-source Society of Automotive Engineers J1939 (SAE J1939) C library and lists possible memory and input bugs. You decide if each finding is a real problem. It does not talk to a real Electronic Control Unit (ECU).
- The first scan is already loaded. Or click Run scan to replay it.
- Click a row. Read: what the line does, why it matters in a vehicle, and the fix.
- On this first scan, every row is a real bug. Choose True positive (the tool is right) and save.
- Use False positive (the tool was wrong) only when the code is actually safe. Not on these four rows.
Reads C files. Does not run the car. Looks for dangerous patterns, such as using a bus byte as an array index.
Throws many random Controller Area Network (CAN) frames at a small test program and watches for a crash.
A language model reads a chunk of C. It can be wrong. You still label true or false.
Each finding is mapped to a Common Weakness Enumeration (CWE) page from MITRE, with a cited link.
Drops noisy matches, sets severity, writes a suggested fix, and keeps the Common Weakness Enumeration (CWE) citation.
Labels you save stay in this browser. The Docker desk stores them in the repository for the next scan.
| No. | Common Weakness Enumeration (CWE) | Severity | File · line | Your label |
|---|
The recorded scan loads in a moment. Then click a row. The lesson for that line opens here.
Why byte 0 must never be trusted as an index
A Transport Protocol Data Transfer (TP.DT) frame carries 8 payload bytes. Byte 0 is the sequence number. The library does index = byte0 − 1. If byte 0 is 0, the unsigned value wraps to 255.
sequence
data
Red tile = attacker-controlled sequence. That is the first finding on this desk.
Prompt injection on Retrieval-Augmented Generation (RAG)
A file named poison.md tells the model to ignore instructions. The allow-list must refuse it. This is not a code bug in J1939. It is a test of our own desk.
Yes. The text asked the model to ignore previous instructions.
Without the allow-list, the poisoned document is loaded into Retrieval-Augmented Generation (RAG).
With the allow-list, poison.md is skipped. Only Common Weakness Enumeration (CWE), Common Vulnerabilities and Exposures (CVE), and ISO/SAE 21434 concept notes are trusted.
Controller Area Network (CAN) — the vehicle bus. Messages are short frames.
Society of Automotive Engineers J1939 (SAE J1939) — a protocol on CAN used on trucks and machinery. This desk analyses an open-source C implementation.
Electronic Control Unit (ECU) — a computer on that bus.
Transport Protocol Connection Management / Data Transfer (TP.CM / TP.DT) — how J1939 splits a long payload into several 8-byte frames.
Common Weakness Enumeration (CWE) — MITRE’s catalogue of bug types. CWE-787 is an out-of-bounds write. CWE-20 is missing input checks.
Common Vulnerabilities and Exposures (CVE) — a public identifier for a specific disclosed vulnerability.
ISO/SAE 21434 — the automotive cybersecurity engineering standard. This desk maps a finding to a communication-item weakness. It is not a full Threat Analysis and Risk Assessment (TARA) or Cybersecurity Management System (CSMS).
True positive — the tool is right; the line is a real problem. False positive — the tool is wrong; the line is safe.