PT-2023-30521 · Px4 · Px4

Pwn9Uin · Publicado 2023-11-13 · Atualizado 2023-11-20 · CVE-2023-47625

Positive Technologies (AI Summary)

CVSS v3.1

2.9

Baixa

Vetor base

AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions PX4 autopilot versions prior to 1.14.0

Description A global buffer overflow vulnerability exists in the CrsfParser TryParseCrsfPacket function due to an invalid size check. This allows a malicious user to create an RC packet remotely, which can trigger the buffer overflow and cause the drone to behave unexpectedly.

Recommendations For versions prior to 1.14.0, upgrade to version 1.14.0 to resolve the issue. As a temporary workaround, consider restricting access to the CrsfParser TryParseCrsfPacket function until the upgrade is applied.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-120

Identificadores relacionados

CVE-2023-47625

GHSA-QPW7-65WW-WJ82

Produtos afetados

Px4

Referências · 7

• 🔥 https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-qpw7-65ww-wj82 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/47xxx/CVE-2023-47625.json · Exploit
• https://github.com/PX4/PX4-Autopilot/commit/d1fcd39a44e6312582c6ab02b0d5ee2599fb55aa · Correção
• https://osv.dev/vulnerability/CVE-2023-47625 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-47625 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1724215179905245529 · Publicação no Twitter
• https://t.me/cvenotify/60811 · Publicação no Telegram