CVE-2024-38951

Executive Summary

CVE-2024-38951 is a buffer overflow vulnerability discovered in PX4-Autopilot v1.12.3, an open-source flight control software stack for drones and unmanned vehicles. The flaw resides in the handling of crafted MavLink messages, allowing an unauthenticated attacker to trigger a Denial of Service (DoS) condition. Successful exploitation causes the autopilot system to crash or become unresponsive, potentially leading to loss of control of the unmanned aerial vehicle (UAV). No public proof-of-concept (PoC) or exploit code has been released, and no patch is currently available from the vendor. The vulnerability is classified as a buffer overflow (CWE-120) and is associated with MITRE ATT&CK tactic T1499 (Endpoint Denial of Service).

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, indicating insufficient data for a formal CVSS v3.1 calculation. However, based on the nature of the vulnerability (buffer overflow via network message), a reasonable estimated vector would be:

• Attack Vector (AV): Network (N) – MavLink messages are typically sent over UDP or TCP.
• Attack Complexity (AC): Low (L) – Crafting a malicious MavLink message requires minimal skill.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerability affects only the vulnerable component.
• Confidentiality (C): None (N) – No data exfiltration.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Complete loss of availability (DoS).

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Estimated Base Score: 7.5 (High)

Threat Level: High – Exploitation can cause immediate loss of UAV control, posing physical safety risks.

Deep Dive & Mechanics

PX4-Autopilot uses the MavLink protocol for communication between ground control stations (GCS) and the flight controller. The vulnerability exists in the message parsing logic, specifically when handling variable-length fields within MavLink messages. A buffer overflow occurs when a crafted message contains a payload that exceeds the allocated buffer size, overwriting adjacent memory regions.

Root Cause: The vulnerable code does not properly validate the length of incoming MavLink message payloads before copying them into fixed-size buffers. This allows an attacker to send a message with a payload length field that is larger than the actual buffer, causing a stack or heap overflow.

Attack Vector: An attacker with network access to the PX4 flight controller (typically on UDP port 14550) can send a specially crafted MavLink message. The message triggers the overflow, corrupting critical data structures such as function pointers or return addresses, leading to a crash or denial of service.

Impact: The immediate impact is a DoS, rendering the autopilot unresponsive. In a real-world scenario, this could cause a drone to lose stabilization, crash, or fail to execute commands. No remote code execution (RCE) has been confirmed, but buffer overflows can sometimes be leveraged for code execution with further analysis.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code is identified in the PX4-Autopilot v1.12.3 source. The issue likely resides in the MavLink message handling functions, such as mavlink_msg_xxx_decode() or custom message parsers.

Vulnerable Code (Conceptual):

// Vulnerable: No length check before memcpy
void parse_mavlink_message(mavlink_message_t *msg) {
    char buffer[64];
    memcpy(buffer, msg->payload, msg->payload_len); // Overflow if payload_len > 64
}

Patched Code (Hypothetical):

// Patched: Length validation
void parse_mavlink_message(mavlink_message_t *msg) {
    char buffer[64];
    if (msg->payload_len > sizeof(buffer)) {
        // Handle error, reject message
        return;
    }
    memcpy(buffer, msg->payload, msg->payload_len);
}

Note: The exact vulnerable function is not publicly disclosed. The above is a representative example of the flaw pattern.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• PX4-Autopilot v1.12.3 running on a flight controller (e.g., Pixhawk) or in simulation (e.g., Gazebo + PX4 SITL).
• Network access to the MavLink port (default UDP 14550).
• A tool to craft and send MavLink messages (e.g., MAVSDK, pymavlink, or custom script).

Exploitation Steps:

1. Identify the target IP and port (e.g., 192.168.1.100:14550).
2. Craft a MavLink message with an oversized payload. For example, using Python with pymavlink:

   from pymavlink import mavutil
   import socket
   
   # Create a UDP socket
   sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
   target = ("192.168.1.100", 14550)
   
   # Craft a malicious MavLink message (e.g., HEARTBEAT with oversized payload)
   # Note: Actual payload structure depends on the vulnerable message type.
   # This is a conceptual example.
   msg = b'\xFE' + b'\xFF' * 1000  # Oversized payload
   sock.sendto(msg, target)
   

3. Send the crafted message repeatedly to ensure the buffer overflow triggers a crash.
4. Observe the target system becoming unresponsive (e.g., no telemetry, loss of control).

Expected Outcome: The flight controller crashes or enters a watchdog reset loop, causing a DoS.

Blue Team (Defense & Detection)

Detection:

• Monitor MavLink traffic for anomalous message lengths (e.g., payload > 256 bytes).
• Use network intrusion detection systems (NIDS) to flag oversized MavLink packets.
• Implement application-level input validation on the flight controller.

Mitigation:

• Isolate the MavLink network from untrusted networks (e.g., use VPNs or dedicated radio links).
• Apply rate limiting on MavLink messages.
• Monitor flight controller logs for crashes or unexpected resets.

Lab Setup for Testing:

• Use PX4 Software-In-The-Loop (SITL) simulation in a controlled environment.
• Tools: Wireshark for traffic analysis, custom Python scripts for message crafting.

Indicators of Compromise (IOCs)

• Network IOCs:

  • MavLink messages with payload length exceeding 256 bytes (typical max for standard messages).
  • UDP packets to port 14550 with irregular message IDs or malformed headers.
  • Repeated connection attempts from a single IP to the MavLink port.

• Host IOCs:

  • Flight controller logs showing ERROR or CRASH events related to MavLink parsing.
  • Unexpected system reboots or watchdog timer resets.
  • Memory corruption errors in debug output (e.g., stack smashing detected).

• File IOCs:

  • Modified MavLink message definition files (if attacker alters firmware).

Detection Engineering

YARA Rule

rule CVE_2024_38951_MavLink_BufferOverflow {
    meta:
        description = "Detects oversized MavLink messages indicative of CVE-2024-38951 exploitation"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-38951"
    strings:
        $mavlink_magic = { FE }  // MavLink v1 magic byte
        $oversized_payload = /.{257,}/  // Payload > 256 bytes
    condition:
        $mavlink_magic at 0 and #oversized_payload > 0
}

Sigma Rule

title: Detection of Oversized MavLink Messages (CVE-2024-38951)
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects network traffic containing MavLink messages with payloads exceeding 256 bytes, indicating potential exploitation of CVE-2024-38951.
author: Valters IT
date: 2025-04-10
tags:
    - attack.t1499
    - cve.2024.38951
logsource:
    category: network_connection
    product: zeek
detection:
    selection:
        udp_dport: 14550
        payload_length: > 256
    condition: selection
falsepositives:
    - Custom MavLink implementations with larger payloads
level: high

Suricata Rule

alert udp any any -> any 14550 (msg:"CVE-2024-38951 MavLink Buffer Overflow Attempt"; content:"|FE|"; offset:0; depth:1; byte_test:2,>,256,1,relative; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Network Segmentation: Isolate the MavLink control network from untrusted networks. Use firewalls to restrict access to UDP port 14550 to only authorized ground control stations.
2. Input Validation: Implement application-level checks on MavLink message payload lengths before processing. Reject messages exceeding expected sizes.
3. Rate Limiting: Apply rate limiting on MavLink messages to reduce the impact of DoS attacks.

Long-Term Fix:

• Monitor the PX4 repository for an official patch. As of now, no patch is available. Consider forking the code and applying a manual fix (as shown in the patched code example).
• Upgrade to a newer version of PX4-Autopilot if a patched release becomes available.

Workarounds:

• Use a proxy or gateway that validates MavLink messages before forwarding them to the flight controller.
• Enable watchdog timers on the flight controller to automatically reset after a crash.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence Division. For questions, contact threatintel@valtersit.com.