Description
A vulnerability was found in PX4 PX4-Autopilot up to 1.16.0. Affected by this issue is the function MavlinkLogHandler::state_listing/MavlinkLogHandler::log_entry_from_id of the file src/modules/mavlink/mavlink_log_handler.cpp. The manipulation results in stack-based buffer overflow. The attack is only possible with local access. The patch is identified as 338595edd1d235efd885fd5e9f45e7f9dcf4013d. It is best practice to apply a patch to resolve this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| PX4 | PX4-Autopilot | 1.0, 1.1, 1.2, 1.3, 1.4, 1.5, 1.6, 1.7, 1.8, 1.9, 1.10, 1.11, 1.12, 1.13, 1.14, 1.15, 1.16.0 | — |
References
- VDB-338527 | PX4 PX4-Autopilot mavlink_log_handler.cpp log_entry_from_id stack-based overflow vdb-entry technical-description
- VDB-338527 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #717323 | PX4 Autopilot main branch Stack-based Buffer Overflow third-party-advisory
- https://github.com/PX4/PX4-Autopilot/issues/26118 issue-tracking
- https://github.com/PX4/PX4-Autopilot/pull/26124 issue-tracking
- https://github.com/PX4/PX4-Autopilot/pull/26124/commits/338595edd1d235efd885fd5e9f45e7f9dcf4013d issue-tracking patch