Attacker Can Execute Arbitrary Code via Dyn_param_handler_ Component in Open Robotics ROS2 Navigation 2

CVE-2024-41644

What is CVE-2024-41644?

A security vulnerability has been identified within the Open Robotics Robotic Operating System 2 Navigation2 framework, specifically affecting the v.humble version. The flaw arises from insecure permissions associated with the dyn_param_handler_ component, enabling unauthorized users to potentially execute arbitrary code. This exposure raises significant concerns over the integrity and security of robotic applications leveraging this operating system. Users and developers are advised to evaluate their deployments and apply necessary mitigations to protect against potential attacks.

References