CVE-2024-24254: dronecode px4_drone_autopilot Race Condition

Vulnerability summary

CVE-2024-24254 is a medium (CVSS 4.2) Race Condition vulnerability in dronecode px4_drone_autopilot. EPSS estimates a 0.36% chance of exploitation in the next 30 days, higher than 28.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 06-02-2024
   PublishedVulnerability first disclosed.
2. 05-06-2025
   Last modifiedVulnerability information updated.

Description

PX4 Autopilot 1.14 and earlier, due to the lack of synchronization mechanism for loading geofence data, has a Race Condition vulnerability in the geofence.cpp and mission_feasibility_checker.cpp. This will result in the drone uploading overlapping geofences and mission routes.

• CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.