Global Buffer Overflow leading to denial of service in PX4-Autopilot
CVE-2023-47625

2.9LOW

Key Information:

Vendor

Px4

Status
Px4-autopilot
Vendor
CVE Published:
13 November 2023

What is CVE-2023-47625?

PX4 autopilot is a flight control solution for drones. In affected versions a global buffer overflow vulnerability exists in the CrsfParser_TryParseCrsfPacket function in /src/drivers/rc/crsf_rc/CrsfParser.cpp:298 due to the invalid size check. A malicious user may create an RC packet remotely and that packet goes into the device where the _rcs_buf reads. The global buffer overflow vulnerability will be triggered and the drone can behave unexpectedly. This issue has been addressed in version 1.14.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

PX4-Autopilot < 1.14.0

References

https://github.com/PX4/PX4-Autopilot/security/advisories/...
x_refsource_CONFIRM
https://github.com/PX4/PX4-Autopilot/commit/d1fcd39a44e63...
x_refsource_MISC

CVSS V3.1

Score:
2.9
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.