Short: Race to Charge: Concurrency Bugs and State Integrity Violations in EV Charging Infrastructure

Electric vehicle (EV) charging infrastructure must juggle hardware control, communication protocols, and cloud-based management all at once, relying on complex event-driven multithreaded software underneath. This paper examines concurrency vulnerabilities in everest-core, an open-source charging framework hosted under the Linux Foundation Energy umbrella. Through manual code auditing of its threading and callback architecture, combined with sanitizer-assisted reproduction experiments, we uncovered 11 concurrency vulnerabilities, all of which now have public CVE IDs. The vulnerabilities fall into three recurring patterns: inconsistent locking discipline, lack of atomicity in state transitions, and missing state validation on asynchronous events. We confirmed eight data races using TSan, ASan, and UBSan, and the remaining three state integrity violations through logic-based proof-of-concept exploits. These bugs can lead to unauthorized charging that persists after a remote stop command, authorization withdrawal bypass, and denial of service through memory corruption.