PX4 Autopilot through 1.17.0 contains a stack buffer over-read vulnerability in the netman system command that fails to validate interface name length. Attackers can supply interface names of 74 bytes or more via the -i option to read beyond buffer boundaries, leaking stack memory to console output or writing it into persistent network configuration files.
Attack Parameters
Attack Vector
Adjacent
Requires local network access
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
None
No data modification
Availability
Low
Partial disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 1
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Px4 Autopilot
cpe:2.3:a:px4:autopilot:*:*:*:*:*:*:*:*
|
— |
<= 1.17.0
|
References 5
https://github.com/PX4/PX4-Autopilot/pull/28483
Fix Pull Request
https://github.com/PX4/PX4-Autopilot/commit/fec216e9d716d96d93b9d882b0c9cf00db3…
Patch Commit
https://github.com/PX4/PX4-Autopilot
NVD
https://github.com/PX4/PX4-Autopilot/blob/v1.17.0/src/systemcmds/netman/netman.…
save() writes snprintf()'s would-be length past line[81], v1.17.0
https://www.vulncheck.com/advisories/px4-autopilot-through-1.17.0-stack-buffer-…
VulnCheck Advisory: PX4 Autopilot through 1.17.0 Stack Buffer Over-read via netman