YAML Deserialization Flaw in Robot Operating System's Dynamic Parameter Tool

CVE-2024-39780

What is CVE-2024-39780?

A vulnerability has been identified in the Robot Operating System (ROS) related to its dynamic parameter tool, 'dynparam.' This issue is caused by improper handling of YAML data via the yaml.load() function in the 'set' and 'get' commands, which can be exploited to create and execute arbitrary Python objects. As a result, both local and remote users may be able to run unintended Python code by manipulating parameters. This vulnerability affects all ROS distributions up to Noetic, prompting significant security concerns within ROS environments. A fix for ROS Noetic has been implemented to mitigate this issue.

References