vulnwire
8.4high

CVE-2024-42002

Unsafe use of eval() method in ros2 topic hz tool

Published 41 d ago · modified 39 d ago · JSON

CVSS
8.4
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.2%
percentile 5%
Public exploits
0
none known

A code injection vulnerability has been discovered in the Robot Operating System 2 (ROS 2) 'ros2topic' command-line tool, affecting all ROS 2 distributions from Crystal Clemmys up to and including Lyrical Luth and Rolling Ridley. The vulnerability lies in the 'hz' verb, which reports the publishing rate of a topic and accepts a user-provided Python expression via the --filter option. This input is passed directly to the eval() function without sanitization, allowing a local user to craft and execute arbitrary code.

CISA SSVC assessment

Exploitation
none
Automatable
no
Technical impact
total
Assessed
39 d ago

Exploit prediction (EPSS)

0.16% probability of exploitation in the next 30 days, higher than 5% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA4.08.6CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA3.18.4CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA4.08.6CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA3.18.4CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Open Source Robotics Foundation Robot Operating System 2 (ROS 2)

Classification

Weakness
  • CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code
  • CWE-94 Improper Control of Generation of Code

References

  • github.com /ros2/ros2cli/pull/1001 · patch
  • github.com /ros2/ros2cli/pull/133#discussion_r223081766 · issue-tracking

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.