PT-2023-30521 · Px4 · Px4

Pwn9Uin · Published 2023-11-13 · Updated 2023-11-20 · CVE-2023-47625

Positive Technologies (AI Summary)

CVSS v3.1

2.9

Low

Base vector

AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions PX4 autopilot versions prior to 1.14.0

Description A global buffer overflow vulnerability exists in the CrsfParser TryParseCrsfPacket function due to an invalid size check. This allows a malicious user to create an RC packet remotely, which can trigger the buffer overflow and cause the drone to behave unexpectedly.

Recommendations For versions prior to 1.14.0, upgrade to version 1.14.0 to resolve the issue. As a temporary workaround, consider restricting access to the CrsfParser TryParseCrsfPacket function until the upgrade is applied.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2023-47625

GHSA-QPW7-65WW-WJ82

Affected Products

Px4

References · 7

• 🔥 https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-qpw7-65ww-wj82 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/47xxx/CVE-2023-47625.json · Exploit
• https://github.com/PX4/PX4-Autopilot/commit/d1fcd39a44e6312582c6ab02b0d5ee2599fb55aa · Patch
• https://osv.dev/vulnerability/CVE-2023-47625 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-47625 · Security Note
• https://twitter.com/VulmonFeeds/status/1724215179905245529 · Twitter Post
• https://t.me/cvenotify/60811 · Telegram Post