CVE-2023-47625: Global Buffer Overflow leading to denial of service in PX4-Autopilot
PX4 autopilot is a flight control solution for drones. In affected versions a global buffer overflow vulnerability exists in the CrsfParserTryParseCrsfPacket function in /src/drivers/rc/crsfrc/CrsfParser.cpp:298 due to the invalid size check. A malicious user may create an RC packet remotely and that packet goes into the device where the rcsbuf reads. The global buffer overflow vulnerability will be triggered and the drone can behave unexpectedly. This issue has been addressed in version 1.14.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-47625?
CVE-2023-47625 is a global buffer overflow vulnerability in PX4-Autopilot that can lead to a denial of service.
What is the severity of CVE-2023-47625?
The severity of CVE-2023-47625 is medium with a CVSS score of 4.3.
How does CVE-2023-47625 affect PX4-Autopilot?
CVE-2023-47625 affects PX4-Autopilot by allowing a malicious user to create an RC packet remotely, leading to a denial of service.
How can I fix CVE-2023-47625?
To fix CVE-2023-47625, it is recommended to update to a patched version of PX4-Autopilot or apply the necessary security patches.
Where can I find more information about CVE-2023-47625?
More information about CVE-2023-47625 can be found in the official GitHub security advisory and commit for PX4-Autopilot.