PT-2024-27792 · Open Robotics · Ros2+1

Published 2024-12-05 · Updated 2024-12-06 · CVE-2024-37861

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions

Description The issue is a buffer overflow that occurs via the nav2 amcl process. This is triggered by sending a crafted .yaml file.

Recommendations For Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions, consider disabling the nav2 amcl process as a temporary workaround until a patch is available. Restrict access to the nav2 amcl process to minimize the risk of exploitation. Avoid using crafted .yaml files in the affected process until the issue is resolved.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2024-37861

Affected Products

Nav2

Ros2

References · 10

• 🔥 https://github.com/GoesM/ROS-CVE-CNVDs · Exploit
• https://osv.dev/vulnerability/CVE-2024-37861 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-37861 · Security Note
• https://github.com/ros-navigation/navigation2/issues/4335 · Note
• https://github.com/ros-navigation/navigation2/issues/4338 · Note
• https://github.com/ros-navigation/navigation2/issues/4005 · Note
• https://twitter.com/VulmonFeeds/status/1864996050869637181 · Twitter Post
• https://t.me/cvenotify/103232 · Telegram Post
• https://twitter.com/CVEnew/status/1864810767251333229 · Twitter Post
• https://t.me/cvedetector/12154 · Telegram Post