Description

PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in TemperatureCalibration::start() due to a race condition between task spawning and object deletion. Attackers can trigger the calibration process via shell commands to write to freed heap memory, corrupting unrelated objects or allocator metadata and destabilizing heap operations.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-09-04T23:18:03.377Z",
  "pubdate": "2026-09-04T23:18:03.377Z",
  "executiveSummary": "A critical use-after-free vulnerability exists in PX4 Autopilot versions up to 1.17.0, specifically within the TemperatureCalibration::start() function.\nThe vulnerability stems from a race condition during task spawning, which allows for the premature deallocation of heap memory while a reference remains active.\nAn attacker with access to the system shell can trigger this condition to facilitate memory corruption, potentially targeting unrelated objects or allocator metadata.\nThe impact includes heap instability and arbitrary memory corruption, which could lead to system crashes (DoS) or potential code execution depending on the heap layout.\nSuccessful exploitation requires local access to the system shell to initiate the calibration command. This flaw poses a significant risk to the integrity of the flight controller's memory management and overall operational stability.",
  "technicalDetails": "The vulnerability resides in the TemperatureCalibration::start() function within the PX4 Autopilot codebase. The root cause is a race condition occurring between the spawning of a calibration task and the subsequent deletion of the object managing that task. Because the task lifecycle management does not sufficiently synchronize object lifetime with the asynchronous execution of the calibration process, a use-after-free (UAF) condition is introduced.\nWhen the TemperatureCalibration::start() function is invoked via a shell command, the system initiates a new task. If the parent process or an error handling routine deletes the TemperatureCalibration object before the spawned task completes or terminates, the task continues to operate on a dangling pointer. This dangling pointer references memory that has been returned to the heap allocator.\nAn attacker can exploit this condition by forcing the calibration process to start and then inducing a condition that triggers the destruction of the object. Once the memory is freed, the attacker can perform heap grooming or spraying to populate the previously freed region with controlled data. When the dangling pointer is later dereferenced by the calibration task, the system performs operations—such as writing to or reading from this memory—using data influenced by the attacker.\nThe attack flow follows these steps: 1) The attacker issues a command to the PX4 shell to trigger the TemperatureCalibration::start() process. 2) The attacker interacts with the system to induce a race condition that results in the deallocation of the heap-allocated object while the task is still scheduled. 3) The attacker performs heap manipulation to reallocate the freed memory block with malicious payloads. 4) The calibration task, continuing to reference the stale pointer, performs operations on the attacker-supplied data. This allows for the corruption of allocator metadata, such as chunk headers, or the overwriting of function pointers or sensitive state variables within adjacent heap objects.\nThis vulnerability is particularly dangerous because it bypasses conventional memory access controls within the internal task-to-heap mapping of the autopilot. Because PX4 often runs in bare-metal or RTOS environments without advanced memory protection unit (MPU) restrictions between all tasks, this corruption can propagate, leading to unpredictable behavior, system failure, or potentially hijacking control flow if execution pointers are successfully overwritten."
}