PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in TemperatureCalibration::start() due to a race condition between task spawning and object deletion. Attackers can trigger the calibration process via shell commands to write to freed heap memory, corrupting unrelated objects or allocator metadata and destabilizing heap operations.
Attack Parameters
Attack Vector
Adjacent
Requires local network access
Attack Complexity
High
Difficult to exploit
Attack Requirements
Present
Additional conditions required
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
Low
Partial data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 1
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Px4 Autopilot
cpe:2.3:a:px4:autopilot:*:*:*:*:*:*:*:*
|
— |
<= 1.17.0
|
References 5
https://github.com/PX4/PX4-Autopilot/pull/28487
Fix Pull Request
https://github.com/PX4/PX4-Autopilot/commit/b182e523d154fe029a49b48bb5f9d3d6693…
Patch Commit
https://github.com/PX4/PX4-Autopilot
NVD
https://github.com/PX4/PX4-Autopilot/blob/v1.17.0/src/modules/temperature_compe…
TemperatureCalibration::start() writes _control_task after spawn, v1.17.0
https://www.vulncheck.com/advisories/px4-autopilot-through-1.17.0-use-after-fre…
VulnCheck Advisory: PX4 Autopilot through 1.17.0 Use-After-Free via Temperature Calibration Task Startup