CVE-2024-38921
📋 TL;DR
CVE-2024-38921 is a critical use-after-free vulnerability in ROS2 Nav2's AMCL component that allows remote attackers to potentially execute arbitrary code or crash the navigation system by sending specially crafted dynamic parameter change requests. This affects ROS2 Humble distributions with Nav2 navigation systems deployed in robots, autonomous vehicles, and industrial automation systems.
💻 Affected Systems
- ROS2 (Robot Operating System 2)
- Nav2 (Navigation2)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, robot hijacking, or safety-critical system failure in autonomous vehicles.
Likely Case
Service disruption through process crashes, navigation system failures, or denial of service affecting robot operations.
If Mitigated
Limited impact with proper network segmentation and parameter validation, potentially only causing service restarts.
🎯 Exploit Status
Exploitation requires sending a specific dynamic parameter change request to the vulnerable process, which is straightforward for attackers with network access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in navigation2 pull request #4397
Vendor Advisory: https://github.com/ros-navigation/navigation2/issues/4379
Restart Required: Yes
Instructions:
1. Update navigation2 package to include fix from PR #4397. 2. Rebuild ROS2 workspace. 3. Restart all nav2_amcl processes and dependent nodes.
🔧 Temporary Workarounds
Disable Dynamic Parameter Reconfiguration
linuxPrevent parameter changes at runtime to block the attack vector
ros2 param set /amcl use_sim_time false
Configure launch files to disable dynamic parameters
Network Segmentation
linuxRestrict network access to ROS2 nodes
sudo ufw deny from any to any port 11311
Configure ROS_DOMAIN_ID isolation
🧯 If You Can't Patch
- Implement strict network access controls to isolate ROS2 nodes from untrusted networks
- Monitor and alert on unexpected parameter change requests to /amcl z_rand parameter
🔍 How to Verify
Check if Vulnerable:
Check if nav2_amcl process is running and if navigation2 package version predates fix from PR #4397Check Version:
ros2 pkg list | grep navigation2 && apt show ros-humble-navigation2Verify Fix Applied:
Verify navigation2 package includes commit from PR #4397 and test parameter changes don't crash process📡 Detection & Monitoring
Log Indicators:
- nav2_amcl process crashes
- Segmentation fault errors in ROS2 logs
- Unexpected parameter change requests to /amcl
Network Indicators:
- Unusual parameter change requests to port 11311 or ROS2 DDS ports
- Traffic patterns targeting /amcl z_rand parameter
SIEM Query:
process_name:"nav2_amcl" AND (event_type:crash OR error_message:"segmentation fault")