Use-After-Free Vulnerability in ROS2 and Nav2

CVE-2024-38927

What is CVE-2024-38927?

A vulnerability present in the Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions has been identified as a use-after-free issue in the nav2_amcl process. This flaw can be exploited when a remote request is sent to alter the dynamic-parameter /amcl do_beamskip. If successfully exploited, it could lead to unintended behavior in the navigation stack, which might affect the integrity and operation of robotic systems utilizing these software versions. Organizations and developers using these products should prioritize patching to ensure security.

References