CVE-2024-38921: Use After Free

Published Dec 6, 2024

Updated

Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2amcl process. This vulnerability is triggered via remotely sending a request for change the value of dynamic-parameter/amcl zrand .

Affected Software

2 affected components

Openrobotics Robot Operating System=2-humble

Openrobotics Robot Operating System=2-iron

Event History

Dec 6, 2024

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·10:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-38921?

CVE-2024-38921 is classified as a high-severity vulnerability due to potential remote exploitation.

How do I fix CVE-2024-38921?

To mitigate CVE-2024-38921, upgrade your Open Robotics Robot Operating System and Nav2 to the latest patched versions.

What systems are affected by CVE-2024-38921?

CVE-2024-38921 affects Open Robotics Robot Operating System 2 versions 2-humble and 2-iron.

What type of vulnerability is CVE-2024-38921?

CVE-2024-38921 is a use-after-free vulnerability that can be triggered via remote parameter changes.

How can CVE-2024-38921 be exploited?

CVE-2024-38921 can be exploited by remotely sending a request to change the dynamic parameter `/amcl z_rand`.