CVE-2024-38952
📋 TL;DR
A buffer overflow vulnerability in PX4-Autopilot v1.14.3 allows attackers to execute arbitrary code or crash the system by exploiting the topic_name parameter in logged_topics.cpp. This affects drone and autonomous vehicle systems using this specific version of the PX4 flight stack. The vulnerability could lead to complete system compromise or denial of service.
💻 Affected Systems
- PX4-Autopilot
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system takeover, potential drone/vehicle hijacking, or permanent system damage
Likely Case
System crash or denial of service causing drone/vehicle to become unresponsive or crash
If Mitigated
Limited impact with proper input validation and memory protections in place
🎯 Exploit Status
Exploitation requires specific knowledge of the logger module and ability to manipulate topic_name parameter
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.14.4 or later
Vendor Advisory: https://github.com/PX4/PX4-Autopilot/issues/23258
Restart Required: Yes
Instructions:
1. Update PX4-Autopilot to v1.14.4 or later
2. Rebuild the flight stack
3. Deploy updated firmware to affected drones/vehicles
4. Restart all affected systems
🔧 Temporary Workarounds
Disable logger module
allTemporarily disable the vulnerable logger module to prevent exploitation
Set parameter SDLOG_MODE=0 in PX4 configuration
Input validation
linuxAdd custom input validation for topic_name parameter
Implement bounds checking in logged_topics.cpp before line 440
🧯 If You Can't Patch
- Isolate affected systems from untrusted networks
- Implement strict input validation and monitoring for abnormal topic_name values
🔍 How to Verify
Check if Vulnerable:
Check PX4 version with 'px4-version' command or inspect firmware version in system logsCheck Version:
px4-version | grep -i versionVerify Fix Applied:
Verify version is v1.14.4 or later and test logger functionality with malformed topic_name inputs📡 Detection & Monitoring
Log Indicators:
- Segmentation faults in logger module
- Abnormally long topic_name strings in logs
- Repeated logger crashes
Network Indicators:
- Unusual network traffic to logger port
- Malformed Mavlink messages targeting topic_name
SIEM Query:
source="px4_logs" AND ("segmentation fault" OR "buffer overflow" OR "logger crash")🔗 References
- https://github.com/PX4/PX4-Autopilot/blob/main/src/modules/logger/logged_topics.cpp#L440
- https://github.com/PX4/PX4-Autopilot/blob/main/src/modules/logger/logged_topics.cpp#L561
- https://github.com/PX4/PX4-Autopilot/issues/23258
- https://github.com/PX4/PX4-Autopilot/blob/main/src/modules/logger/logged_topics.cpp#L440
- https://github.com/PX4/PX4-Autopilot/blob/main/src/modules/logger/logged_topics.cpp#L561
- https://github.com/PX4/PX4-Autopilot/issues/23258
