PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in the load_mon module's stop path where exit_and_cleanup() deletes the LoadMon object and frees the performance counter before perf_end() attempts to access it. Attackers can trigger this vulnerability by issuing the load_mon stop command from any PXH or MAVLink shell, causing reads and writes through freed memory that corrupt heap objects and destabilize the flight stack.
Attack Parameters
Attack Vector
Adjacent
Requires local network access
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
Low
Partial data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 1
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Px4 Autopilot
cpe:2.3:a:px4:autopilot:*:*:*:*:*:*:*:*
|
— |
<= 1.17.0
|
References 5
https://github.com/PX4/PX4-Autopilot/pull/28544
Fix Pull Request
https://github.com/PX4/PX4-Autopilot/commit/354823e2efd8dd7ac47f4b8984b8e0fb06d…
Patch Commit
https://github.com/PX4/PX4-Autopilot
NVD
https://github.com/PX4/PX4-Autopilot/blob/v1.17.0/src/modules/load_mon/LoadMon.…
LoadMon::Run() calls perf_end(_cycle_perf) after exit_and_cleanup(), v1.17.0
https://www.vulncheck.com/advisories/px4-autopilot-through-1.17.0-use-after-fre…
VulnCheck Advisory: PX4 Autopilot through 1.17.0 Use-After-Free in load_mon