PT-2024-23694 · Open Robotics · Ros2+1

Goesm · Published 2024-12-05 · Updated 2024-12-06 · CVE-2024-30964

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Open Robotics Robotic Operating System 2 (ROS2) navigation2- ROS2-humble and navigation 2-humble

Description The issue allows a local attacker to execute arbitrary code via the initial pose sub thread created by nav2 bt navigator. This is due to an Insecure Permissions vulnerability in the Open Robotics Robotic Operating System 2 (ROS2) navigation2.

Recommendations For Open Robotics Robotic Operating System 2 (ROS2) navigation2- ROS2-humble and navigation 2-humble, consider restricting access to the nav2 bt navigator function to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-30964

Affected Products

Ros2

Navigation2

References · 9

• 🔥 https://github.com/GoesM/ROS-CVE-CNVDs · Exploit
• https://osv.dev/vulnerability/CVE-2024-30964 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-30964 · Security Note
• https://github.com/ros-planning/navigation2/issues/4166 · Note
• https://github.com/ros-planning/navigation2/pull/4176 · Note
• https://twitter.com/VulmonFeeds/status/1864998610997330148 · Twitter Post
• https://twitter.com/CVEnew/status/1864810764998992373 · Twitter Post
• https://t.me/cvedetector/12152 · Telegram Post
• https://t.me/cvenotify/103230 · Telegram Post