PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, tattu_can contains an unbounded memcpy in its multi-frame assembly loop, allowing stack memory overwrite when crafted CAN frames are processed. In deployments where tattu_can is enabled and running, a CAN-injection-capable attacker can trigger a crash (DoS) and memory corruption.
This vulnerability is fixed in 1.17.0-rc2.
Attack Parameters
Attack Vector
Physical
Requires physical access
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products 4
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Dronecode Px4_Drone_Autopilot
cpe:2.3:a:dronecode:px4_drone_autopilot:*:*:*:*:*:*:*:*
|
— |
1.17.0
|
|
Dronecode Px4_Drone_Autopilot
cpe:2.3:a:dronecode:px4_drone_autopilot:1.17.0:alpha1:*:*:*:*:*:*
|
— | — |
|
Dronecode Px4_Drone_Autopilot
cpe:2.3:a:dronecode:px4_drone_autopilot:1.17.0:beta1:*:*:*:*:*:*
|
— | — |
|
Dronecode Px4_Drone_Autopilot
cpe:2.3:a:dronecode:px4_drone_autopilot:1.17.0:rc1:*:*:*:*:*:*
|
— | — |