CVE-2023-46256

CVSS V2 None CVSS V3 None

Description

PX4-Autopilot provides PX4 flight control solution for drones. In versions 1.14.0-rc1 and prior, PX4-Autopilot has a heap buffer overflow vulnerability in the parser function due to the absence of `parserbuf_index` value checking. A malfunction of the sensor device can cause a heap buffer overflow with leading unexpected drone behavior. Malicious applications can exploit the vulnerability even if device sensor malfunction does not occur. Up to the maximum value of an `unsigned int`, bytes sized data can be written to the heap memory area. As of time of publication, no fixed version is available.

Overview

CVE ID
CVE-2023-46256

Assigner
GitHub_M

Vulnerability Status
PUBLISHED

Published Version
2023-10-31T15:29:05.943Z

Last Modified Date
2023-10-31T15:29:05.943Z

Weakness Enumerations

CWE	URL
CWE-122	http://cwe.mitre.org/data/definitions/122.html
CWE-120	http://cwe.mitre.org/data/definitions/120.html

References

Reference URL	Reference Tags
https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-5hvv-q2r5-rppw	x_refsource_CONFIRM
https://github.com/PX4/PX4-Autopilot/blob/main/src/drivers/distance_sensor/lightware_laser_serial/parser.cpp#L87	x_refsource_MISC

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2023-46256
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46256

History

Created	Old Value	New Value	Data Type	Notes
2024-06-24 22:56:47				Added to TrackCVE