CVE-2024-33903 identifies a vulnerability in the CARLA autonomous driving simulator, specifically in versions through 0.9.15.2. The issue arises from the collision sensor's mishandling of certain scenarios involving pedestrians or bicycles. This mishandling is partly due to the collision sensor function not being exposed to the Blueprint library, which is a scripting system used within CARLA for simulation control and customization. As a result, the collision sensor may fail to accurately detect or process collisions in these specific cases, potentially leading to incorrect simulation results. The vulnerability has a CVSS 3.1 base score of 5.9, indicating medium severity. The vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) shows that the attack is network-based, requires high attack complexity, no privileges, and no user interaction, with no impact on confidentiality or availability but with integrity impact. No patches or known exploits are currently available. The weakness is classified under CWE-693, which relates to protection mechanism failures. This vulnerability primarily affects the integrity of simulation data, which can mislead developers relying on CARLA for autonomous vehicle testing and validation.

The primary impact of this vulnerability is on the integrity of simulation data generated by CARLA. Inaccurate collision detection involving pedestrians or bicycles can lead to flawed simulation outcomes, which may cause developers to draw incorrect conclusions about autonomous vehicle behavior and safety. This can delay development cycles, increase testing costs, and potentially result in unsafe autonomous driving systems if undetected errors propagate into real-world deployments. Since CARLA is widely used in academic research, industry R&D, and autonomous vehicle testing, the scope of affected systems includes any organization or entity using vulnerable versions of CARLA for simulation. There is no direct impact on confidentiality or availability, and no known active exploitation reduces immediate risk. However, the reliance on simulation accuracy in safety-critical autonomous vehicle development makes this vulnerability significant for organizations in this sector.

Currently, no official patches are available for this vulnerability. Organizations should monitor CARLA project updates closely and apply patches promptly once released. In the interim, developers can implement custom collision detection logic or extend the Blueprint library to expose and properly handle collision sensor functions for pedestrians and bicycles. Conducting additional validation and cross-checking simulation results with alternative tools or real-world data can help identify discrepancies caused by this vulnerability. Restricting network access to CARLA simulation environments and limiting exposure to untrusted inputs can reduce attack surface. Additionally, organizations should incorporate this vulnerability into their risk assessments and testing protocols to ensure simulation integrity is maintained until a fix is available.