Xiaoyang Chen

PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in the load mon module's stop path where exit and cleanup() deletes the LoadMon object and frees the performance counter before perf end() attempts to access it. Attackers can trigger this vulnerability by issuing the load mon stop command from any PXH or MAVLink shell, causing reads and writes through freed memory that corrupt heap objects and destabilize the flight stack.

PX4 Autopilot through 1.17.0 contains a stack buffer over-read vulnerability in the netman system command that fails to validate interface name length. Attackers can supply interface names of 74 bytes or more via the -i option to read beyond buffer boundaries, leaking stack memory to console output or writing it into persistent network configuration files.

PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in TemperatureCalibration::start() due to a race condition between task spawning and object deletion. Attackers can trigger the calibration process via shell commands to write to freed heap memory, corrupting unrelated objects or allocator metadata and destabilizing heap operations.

PX4 Autopilot through 1.17.0 contains a null pointer dereference vulnerability in param set default file() and param set backup file() functions that allows attackers to crash the autopilot process. Attackers can invoke 'param select' or 'param select-backup' commands with no path argument from any PX4 shell to trigger the crash.

**Name of the Vulnerable Software and Affected Versions** PX4 Autopilot (affected versions not specified) **Description** A heap buffer overflow exists in the `sd bench` command. The issue occurs when a four-byte block number is written into a memory allocation whose size is supplied by the user. If an attacker invokes `sd bench` with a block size smaller than four bytes, it can lead to a heap buffer overflow, potentially resulting in system crashes or arbitrary code execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.