CVE-2024-24254

{"id": "CVE-2024-24254", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.2, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 1.6}]}, "published": "2024-02-06T22:16:15.010", "references": [{"url": "https://github.com/Drone-Lab/PX4-Autopilot/blob/report-can-not-pause-vulnerability/Multi-Threaded%20Race%20Condition%20bug%20found%20in%20PX4%20cause%20drone%20can%20not%20PAUSE.md", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/PX4/PX4-Autopilot", "tags": ["Product"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-362"}]}], "descriptions": [{"lang": "en", "value": "PX4 Autopilot 1.14 and earlier, due to the lack of synchronization mechanism for loading geofence data, has a Race Condition vulnerability in the geofence.cpp and mission_feasibility_checker.cpp. This will result in the drone uploading overlapping geofences and mission routes."}, {"lang": "es", "value": "PX4 Autopilot 1.14 y versiones anteriores, debido a la falta de un mecanismo de sincronizaci\u00f3n para cargar datos de geovalla, tiene una vulnerabilidad de condici\u00f3n de ejecuci\u00f3n en geofence.cpp y Mission_feasibility_checker.cpp. Esto dar\u00e1 como resultado que el dron cargue geocercas y rutas de misi\u00f3n superpuestas."}], "lastModified": "2024-02-15T18:46:57.737", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dronecode:px4_drone_autopilot:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6F32F0BB-E3F9-41EE-BD92-A28945CAF9B8", "versionEndIncluding": "1.14.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}