GoesM/ROS-CVE-CNVDs

GitHub

github.com

Releases0

Stars6

record and public CVE/CNVD IDs discovered by my works

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2024-41649 ↗	Dec 6, 2024Friday, 6 December 2024, 22:15	9.8 CRITICAL	—
Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a crafted script to the executor_thread_.
CVE-2024-44856 ↗	Dec 6, 2024Friday, 6 December 2024, 22:15	7.5 HIGH	—
Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble was discovered to contain a NULL pointer dereference via the component nav2_smac_planner().
CVE-2024-44855 ↗	Dec 6, 2024Friday, 6 December 2024, 22:15	7.5 HIGH	—
Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble was discovered to contain a NULL pointer dereference via the component nav2_navfn_planner().
CVE-2024-44854 ↗	Dec 6, 2024Friday, 6 December 2024, 22:15	7.5 HIGH	—
Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble was discovered to contain a NULL pointer dereference via the component smoothPlan().
CVE-2024-44853 ↗	Dec 6, 2024Friday, 6 December 2024, 22:15	7.5 HIGH	—
Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble was discovered to contain a NULL pointer dereference via the component computeControl().
CVE-2024-44852 ↗	Dec 6, 2024Friday, 6 December 2024, 22:15	9.8 CRITICAL	—
Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble was discovered to contain a segmentation violation via the component theta_star::ThetaStar::isUnsafeToPlan().
CVE-2024-41650 ↗	Dec 6, 2024Friday, 6 December 2024, 22:15	9.8 CRITICAL	—
Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a crafted script to the nav2_costmap_2d.
CVE-2024-41648 ↗	Dec 6, 2024Friday, 6 December 2024, 22:15	9.8 CRITICAL	—
Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a crafted script to the nav2_regulated_pure_pursuit_controller.
CVE-2024-38926 ↗	Dec 6, 2024Friday, 6 December 2024, 22:15	9.8 CRITICAL	—
Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerability is triggered via remotely sending a request for change the value of dynamic-parameter `/amcl z_short`.
CVE-2024-41647 ↗	Dec 6, 2024Friday, 6 December 2024, 22:15	9.8 CRITICAL	—
Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a crafted script to the nav2_mppi_controller.
CVE-2024-41646 ↗	Dec 6, 2024Friday, 6 December 2024, 22:15	9.8 CRITICAL	—
Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a crafted script to the nav2_dwb_controller.
CVE-2024-41645 ↗	Dec 6, 2024Friday, 6 December 2024, 22:15	9.8 CRITICAL	—
Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a crafted script to the nav2__amcl.
CVE-2024-41644 ↗	Dec 6, 2024Friday, 6 December 2024, 22:15	9.8 CRITICAL	—
Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via the dyn_param_handler_ component.
CVE-2024-38927 ↗	Dec 6, 2024Friday, 6 December 2024, 22:15	9.8 CRITICAL	—
Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerability is triggered via remotely sending a request to change the value of dynamic-parameter `/amcl do_beamskip`.
CVE-2024-38925 ↗	Dec 6, 2024Friday, 6 December 2024, 22:15	9.8 CRITICAL	—
Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerability is triggered via remotely sending a request for change the value of dynamic-parameter`/amcl z_max` .
CVE-2024-38924 ↗	Dec 6, 2024Friday, 6 December 2024, 22:15	9.8 CRITICAL	—
Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerability is triggered via remotely sending a request to change the value of dynamic-parameter`/amcl laser_model_type` .
CVE-2024-38923 ↗	Dec 6, 2024Friday, 6 December 2024, 22:15	9.8 CRITICAL	—
Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerability is triggered via remotely sending a request to change the value of dynamic-parameter`/amcl odom_frame_id` .
CVE-2024-38922 ↗	Dec 6, 2024Friday, 6 December 2024, 22:15	9.8 CRITICAL	—
Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble version was discovered to contain a heap overflow in the nav2_amcl process. This vulnerability is triggered via sending a crafted message to the component /initialpose.
CVE-2024-38921 ↗	Dec 6, 2024Friday, 6 December 2024, 22:15	9.8 CRITICAL	—
Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerability is triggered via remotely sending a request for change the value of dynamic-parameter`/amcl z_rand ` .
CVE-2024-38910 ↗	Dec 5, 2024Thursday, 5 December 2024, 23:15	7.5 HIGH	—
Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble version was discovered to contain a use-after-free in the nav2_amcl process. This vulnerability is triggered via sending a request to change dynamic parameters.
CVE-2024-38920 ↗	Dec 5, 2024Thursday, 5 December 2024, 23:15	9.1 CRITICAL	—
Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerability is triggerd via remotely sending a request for change the value of dynamic-parameter`/amcl max_beams` .
CVE-2024-37863 ↗	Dec 5, 2024Thursday, 5 December 2024, 23:15	9.8 CRITICAL	—
Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a buffer overflow via the nav2_amcl process. This vulnerability is triggered via sending a crafted .yaml file.
CVE-2024-30961 ↗	Dec 5, 2024Thursday, 5 December 2024, 23:15	7.8 HIGH	—
Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 (ROS2) navigation2- ROS2-humble and navigation 2-humble allows a local attacker to execute arbitrary code via the error-thrown mechanism in nav2_bt_navigator.
CVE-2024-37862 ↗	Dec 5, 2024Thursday, 5 December 2024, 23:15	7.3 HIGH	—
Buffer Overflow vulnerability in Open Robotic Robotic Operating System 2 ROS2 navigation2- ROS2-humble&& navigation2-humble allows a local attacker to execute arbitrary code via a crafted .yaml file to the nav2_planner process.
CVE-2024-37861 ↗	Dec 5, 2024Thursday, 5 December 2024, 23:15	9.8 CRITICAL	—
Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a buffer overflow via the nav2_amcl process. This vulnerability is triggered via sending a crafted .yaml file.
CVE-2024-37860 ↗	Dec 5, 2024Thursday, 5 December 2024, 23:15	7.3 HIGH	—
Buffer Overflow vulnerability in Open Robotic Operating System 2 ROS2 navigation2- ROS2-humble&& navigation2-humble allows a local attacker to execute arbitrary code via a crafted .yaml file to the nav2_amcl process
CVE-2024-30964 ↗	Dec 5, 2024Thursday, 5 December 2024, 23:15	7.8 HIGH	—
Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 (ROS2) navigation2- ROS2-humble and navigation 2-humble allows a local attacker to execute arbitrary code via the initial_pose_sub thread created by nav2_bt_navigator
CVE-2024-30963 ↗	Dec 5, 2024Thursday, 5 December 2024, 23:15	7.8 HIGH	—
Buffer Overflow vulnerability in Open Robotics Robotic Operating System 2 (ROS2) navigation2- ROS2-humble and navigation 2-humble allows a local attacker to execute arbitrary code via a crafted script.
CVE-2024-30962 ↗	Dec 5, 2024Thursday, 5 December 2024, 23:15	7.8 HIGH	—
Buffer Overflow vulnerability in Open Robotics Robotic Operating System 2 (ROS2) navigation2- ROS2-humble and navigation 2-humble allows a local attacker to execute arbitrary code via the nav2_amcl process