PX4 Netman 栈缓冲区越界读漏洞分析与修复

漏洞总结 漏洞概述 类型：栈缓冲区越界读（Stack Buffer Over-read） 位置： 根因： 函数中， 缓冲区仅能容纳 80 字节（含终止符 NUL），但 写入的 长度可能超过 80 字节，导致 读取未初始化的栈内存。 触发条件：接口名称长度 ≥ 74 字节时， 会读取超出 声明范围的栈内存。 影响范围 受影响组件： 模块（ / 命令） 受影响平台：PX4/NutIX 目标，启用 时 影响： - 栈内存泄露到控制台（ ） - 栈内存泄露到持久化网络配置文件（ ） - 可能导致进程崩溃或系统不稳定（越界读超出有效内存边界） 修复方案 PR #28483： 修复内容：在 函数中添加接口名称长度检查，防止过长的接口名称导致越界读。 状态：已合并（Merged），由 提交， 审核通过。 POC 代码 触发越界读的 POC 预期输出（栈内存泄露到控制台） ``` $ netman show -i AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA NETMAN-253,259,258 NETMAN-253,259,258 NETMAN-253,259,258 NETMAN-253,259,258 NETMAN-253,259,258 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-253,258,259 NETMAN-2

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

PX4 Netman 栈缓冲区越界读漏洞分析与修复

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

PX4 Netman 栈缓冲区越界读漏洞分析与修复

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！