PX4-Autopilot Stack Buffer Overflow Vulnerability in MAVLink Receiver

A stack buffer overflow vulnerability has been identified in PX4-Autopilot version 1.14.3, specifically within the MAVLink receiver module. This vulnerability arises from improper validation of the size of the 'serial_control_mavlink.count' and 'serial_control_mavlink.data' fields. When a MAVLink message of type 'SERIAL_CONTROL' is received, the vulnerability can be exploited, leading to a program crash and a denial-of-service condition during software simulation.

Impact

Exploitation of this vulnerability causes a stack buffer overflow, leading to a program crash and a denial-of-service condition. According to the GitHub Advisory Database, this vulnerability has a CVSS v3.1 score of 7.8.

Reproduction

The vulnerability can be reproduced by sending a MAVLINK message with the 'SERIAL_CONTROL' type to a PX4-Autopilot v1.14.3 instance. This can be done using the 'jmavsim' simulation environment. The 'poc.py' Python script, available in the GitHub repository 'zhangteng0526/px4_stack-over-flow', can be used to automate the process of sending the malicious MAVLINK message that triggers the buffer overflow.

Remediation

Users are advised to update to the latest version of PX4-Autopilot, as this vulnerability has been patched in version 1.14.3.