CVE-2024-38922
Severity CVSS v4.0:
Pending analysis
Type:
CWE-787
Out-of-bounds Write
Publication date:
06/12/2024
Last modified:
17/12/2024
Description
Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble version was discovered to contain a heap overflow in the nav2_amcl process. This vulnerability is triggered via sending a crafted message to the component /initialpose.
Impact
Base Score 3.x
9.80
Severity 3.x
CRITICAL
Vulnerable products and versions
CPE | From | Up to |
---|---|---|
cpe:2.3:a:openrobotics:robot_operating_system:2:humble:*:*:*:*:*:* | ||
cpe:2.3:a:openrobotics:robot_operating_system:2:iron:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- https://github.com/GoesM/ROS-CVE-CNVDs
- https://github.com/open-navigation/navigation2/issues/4307
- https://github.com/ros-navigation/navigation2/issues/4294
- https://github.com/ros-navigation/navigation2/pull/4301
- https://github.com/open-navigation/navigation2/issues/4307
- https://github.com/ros-navigation/navigation2/issues/4294