by Kastro
Paper/Archive/CVE-2024-39780

CVE-2024-39780

Open Source Robotics Foundation Robot Operating System (ROS) — Use of unsafe yaml load in dynparam

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
36
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 34.6.346 × 206.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A YAML deserialization vulnerability was found in the Robot Operating System (ROS) 'dynparam', a command-line tool for getting, setting, and deleting parameters of a dynamically configurable node, affecting ROS distributions Noetic and earlier. The issue is caused by the use of the yaml.load() function in the 'set' and 'get' verbs, and allows for the creation of arbitrary Python objects. Through this flaw, a local or remote user can craft and execute arbitrary Python code.

Affected

ProductAffectedFixed inSource
Robot Operating System (ROS)Noetic Ninjemys–CNA
Robot Operating System (ROS)Melodic Morenia–CNA
Robot Operating System (ROS)Kinetic Kame–CNA
Robot Operating System (ROS)Indigo Igloo–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
canonical (CNA)7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/ros/dynamic_reconfigure/pull/202