CVE-2024-38923
📋 TL;DR
This CVE describes a use-after-free vulnerability in ROS2 Nav2's AMCL process that can be triggered remotely by sending a request to change the dynamic parameter '/amcl odom_frame_id'. Attackers can exploit this to potentially execute arbitrary code or crash the nav2_amcl service. Systems running ROS2 Humble with Nav2 are affected.
💻 Affected Systems
- ROS2 (Robot Operating System 2)
- Nav2 (Navigation2)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, privilege escalation, or denial of service affecting robot navigation capabilities.
Likely Case
Service crash causing navigation failures, potential memory corruption leading to unstable robot behavior.
If Mitigated
Limited impact if proper network segmentation and parameter validation are in place, potentially just service restart.
🎯 Exploit Status
Exploitation requires sending a specific parameter change request via ROS2 communication, which is straightforward for anyone with network access to the ROS2 system.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in navigation2 pull request #4397
Vendor Advisory: https://github.com/ros-navigation/navigation2/issues/4379
Restart Required: Yes
Instructions:
1. Update navigation2 package to include pull request #4397. 2. Rebuild ROS2 workspace. 3. Restart nav2_amcl and related navigation services.
🔧 Temporary Workarounds
Disable dynamic parameter reconfiguration
linuxPrevent parameter changes at runtime to block the attack vector
ros2 param set /amcl use_sim_time true
Configure launch files to disable dynamic parameters
Network segmentation
allIsolate ROS2 network from untrusted systems
Use ROS2 domain IDs to separate networks
Implement firewall rules to restrict ROS2 port access
🧯 If You Can't Patch
- Implement strict network access controls to limit who can communicate with the ROS2 system
- Monitor for parameter change requests to '/amcl odom_frame_id' and alert on suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check if running ROS2 Humble with Nav2 before the fix in PR #4397. Review navigation2 version and commit history.Check Version:
ros2 pkg list | grep navigation2 && cd $(ros2 pkg prefix navigation2) && git log --oneline -1Verify Fix Applied:
Verify navigation2 includes commit from PR #4397. Test parameter changes to confirm no crashes occur.📡 Detection & Monitoring
Log Indicators:
- nav2_amcl process crashes
- Segmentation faults in nav2 logs
- Unexpected parameter change requests
Network Indicators:
- ROS2 parameter change requests to '/amcl odom_frame_id' from unexpected sources
- Unusual ROS2 topic traffic patterns
SIEM Query:
source="ros2_logs" AND ("segmentation fault" OR "nav2_amcl crashed" OR "parameter /amcl odom_frame_id")