ROS2 Navigation Stack (Nav2) Vulnerability
CVE-2024-38922

9.8CRITICAL

Key Information:

Vendor

Open Robotics

Status
Robot Operating System
Vendor
CVE Published:
6 December 2024

What is CVE-2024-38922?

A vulnerability has been identified in the Open Robotics Robot Operating System 2 (ROS2) and the Nav2 Humble version, characterized by a heap overflow in the nav2_amcl process. This vulnerability can be exploited by sending specially crafted messages to the /initialpose component, potentially allowing unauthorized actions within the affected systems. Proper safeguards and security updates are essential for users to mitigate risks associated with this vulnerability.

References

https://github.com/ros-navigation/navigation2/issues/4294
https://github.com/open-navigation/navigation2/issues/4307
https://github.com/ros-navigation/navigation2/pull/4301

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.