CVE-2024-38952

Executive Summary

CVE-2024-38952 is a buffer overflow vulnerability discovered in PX4-Autopilot v1.14.3, specifically within the /logger/logged_topics.cpp file. The flaw resides in the handling of the topic_name parameter, which can be exploited to cause a buffer overflow. This vulnerability could allow an attacker to crash the autopilot system or potentially execute arbitrary code, posing a significant risk to unmanned aerial vehicles (UAVs) and other autonomous systems relying on PX4. The vulnerability has a CVSS score of 0.0, indicating that it has not been fully assessed, but the potential impact is severe due to the critical nature of the affected systems.

CVSS Breakdown & Threat Level

The CVSS score is currently 0.0, meaning no official vector has been assigned. However, based on the nature of the vulnerability (buffer overflow in a network-facing component), a hypothetical vector could be:

• Attack Vector (AV): Network (N) – The logger component may accept network inputs.
• Attack Complexity (AC): Low (L) – Exploitation likely requires minimal skill.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerability affects only the vulnerable component.
• Confidentiality (C): High (H) – Potential for data leakage.
• Integrity (I): High (H) – Potential for code execution.
• Availability (A): High (H) – Potential for system crash.

Threat Level: Critical. Exploitation could lead to full compromise of the UAV, including loss of control, data theft, or physical damage.

Deep Dive & Mechanics

The vulnerability is located in the logged_topics.cpp file, which handles the logging of topics in PX4-Autopilot. The topic_name parameter is used to specify which topics to log. A buffer overflow occurs when the input topic_name exceeds the allocated buffer size, leading to memory corruption. This can be triggered by sending a specially crafted request to the logger component.

The root cause is the lack of proper bounds checking on the topic_name input. The code likely uses a fixed-size buffer without validating the length of the input, allowing an attacker to overwrite adjacent memory regions. This can lead to a denial of service (crash) or, with careful crafting, arbitrary code execution.

Vulnerable vs. Patched Code

Vulnerable Code (v1.14.3):

// Example vulnerable code snippet
char buffer[64];
strcpy(buffer, topic_name); // No bounds checking

Patched Code (Hypothetical):

// Example patched code snippet
char buffer[64];
strncpy(buffer, topic_name, sizeof(buffer) - 1);
buffer[sizeof(buffer) - 1] = '\0'; // Ensure null termination

The patched version uses strncpy to limit the copy size and ensures null termination, preventing buffer overflow.

Exploitation & Lab Setup

Red Team

Exploitation Steps:

1. Identify Target: Scan for PX4-Autopilot instances (e.g., using Shodan dorks: "PX4-Autopilot").
2. Craft Payload: Create a payload that sends an overly long topic_name to the logger endpoint.
3. Trigger Overflow: Send the payload to the target's logger service.
4. Achieve Code Execution: Use ROP chains or shellcode injection to execute arbitrary commands.

Example Payload (Python):

import socket

target_ip = "192.168.1.100"
target_port = 14556  # Example port

payload = b"A" * 1000  # Overflow buffer
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.sendto(payload, (target_ip, target_port))
sock.close()

Blue Team

Detection and Mitigation:

1. Monitor Logs: Look for unusually long topic_name strings in logger logs.
2. Network Monitoring: Detect anomalous UDP packets to logger ports.
3. Harden Systems: Apply input validation and use safe string functions.
4. Patch: Apply vendor patch when available.

Indicators of Compromise (IOCs)

• Network: UDP packets with excessively long payloads to ports 14556 or 14557.
• System: Crashes or restarts of the PX4 autopilot process.
• Logs: Entries with truncated or malformed topic names in /logger/logged_topics.log.
• Memory: Corrupted memory regions in the autopilot process.

Detection Engineering

YARA Rule

rule CVE_2024_38952_PX4_BufferOverflow {
    meta:
        description = "Detects buffer overflow attempts in PX4-Autopilot logger"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-38952"
    strings:
        $s1 = "topic_name" ascii wide nocase
        $s2 = "logged_topics" ascii wide nocase
        $overflow = { 41 41 41 41 41 41 41 41 } // 8 consecutive 'A's
    condition:
        $s1 and $s2 and #overflow > 10
}

Sigma Rule

title: CVE-2024-38952 PX4-Autopilot Buffer Overflow
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects buffer overflow attempts via topic_name parameter
author: Valters IT
date: 2024/10/27
logsource:
    category: application
    product: px4
detection:
    selection:
        EventID: 1001
        Data|contains: "topic_name"
        Data|length: > 256
    condition: selection
falsepositives:
    - Legitimate long topic names (unlikely)
level: high

Suricata Rule

alert udp any any -> any 14556 (msg:"CVE-2024-38952 PX4-Autopilot Buffer Overflow Attempt"; content:"topic_name"; depth:100; byte_test:1,>,64,0; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the logger service if not required.
2. Short-term: Implement input validation and use safe string functions (e.g., strncpy).
3. Long-term: Apply vendor patch when available. Monitor for updates from PX4.
4. Network: Restrict access to logger ports using firewalls.
5. Monitoring: Deploy detection rules (YARA, Sigma, Suricata) to identify exploitation attempts.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert