Executive brief
Firmament-Autopilot FMT-Firmware is an open-source autopilot system used for controlling unmanned aerial vehicles (UAVs) and drones. A technical flaw was identified where a specific background task (mavobc) is assigned less memory than it actually requires to run its complex mathematical calculations. This could lead to a system crash or unpredictable behavior during flight operations, potentially resulting in a loss of control or hardware damage.
Technical details
A stack overflow vulnerability exists in the 'task_mavobc_entry' thread function within '/src/task/comm/task_comm.c'. The task is statically allocated a stack size of 4096 bytes; however, static analysis of the call graph (including functions like ellipsoid_fit_solve and xzggev) reveals a potential stack usage of approximately 4400 bytes. This discrepancy occurs during complex operations such as magnetometer calibration. An attacker or specific operational conditions that trigger these deep call stacks could cause a stack exhaustion/overflow, leading to memory corruption or a kernel panic. The issue was identified via manual stack usage analysis using the -fstack-usage compiler flag.
Affected products
- Firmament-Autopilot FMT-Firmware commit de5aecb
Timeline
- 2024-11-11: disclosed: Issue reported on GitHub repository
- 2026-05-13: advisory: CVE published to NVD