CVE-2024-25198
📋 TL;DR
This CVE describes a use-after-free vulnerability in ROS2 Nav2's AMCL node due to incorrect pointer reset order. Attackers could exploit this to crash the navigation system or potentially execute arbitrary code. Systems running ROS2 Humble with Nav2 are affected.
💻 Affected Systems
- ROS2 Navigation2 (Nav2)
- ROS2 Humble
📦 What is this software?
Nav2 by Opennav
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, allowing attackers to take control of robotic systems or underlying infrastructure.
Likely Case
Application crash causing navigation failures in autonomous systems, potentially leading to operational disruption or safety issues.
If Mitigated
Limited impact with proper memory protection mechanisms and exploit mitigations in place.
🎯 Exploit Status
Exploitation requires sending specific messages to trigger the use-after-free condition
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Patched in navigation2 pull requests #4068 and #4070
Vendor Advisory: https://github.com/ros-planning/navigation2/pull/4068
Restart Required: Yes
Instructions:
1. Update ROS2 Humble installation
2. Pull latest navigation2 repository
3. Rebuild and reinstall Nav2 packages
4. Restart affected ROS2 nodes
🔧 Temporary Workarounds
Disable AMCL node
linuxTemporarily disable the vulnerable AMCL localization component
ros2 lifecycle set /amcl_node shutdown
🧯 If You Can't Patch
- Implement network segmentation to isolate ROS2 systems
- Deploy memory protection mechanisms like ASLR and stack canaries
🔍 How to Verify
Check if Vulnerable:
Check if amcl_node.cpp lines 331-344 contain the vulnerable pointer reset orderCheck Version:
ros2 pkg list | grep navigation2Verify Fix Applied:
Verify that laser_scan_filter_.reset() is called before tf_listener_.reset() in amcl_node.cpp📡 Detection & Monitoring
Log Indicators:
- Segmentation faults in amcl_node
- Memory access violation errors
- Unexpected AMCL node restarts
Network Indicators:
- Unusual ROS2 topic subscriptions to AMCL
- Suspicious message patterns to localization topics
SIEM Query:
process:amcl_node AND (event_id:1000 OR severity:critical)🔗 References
- https://github.com/ros-planning/navigation2/blob/main/nav2_amcl/src/amcl_node.cpp#L331-L344
- https://github.com/ros-planning/navigation2/pull/4068
- https://github.com/ros-planning/navigation2/pull/4070
- https://github.com/ros-planning/navigation2/blob/main/nav2_amcl/src/amcl_node.cpp#L331-L344
- https://github.com/ros-planning/navigation2/pull/4068
- https://github.com/ros-planning/navigation2/pull/4070
