Description
A security vulnerability has been detected in AprilRobotics apriltag up to 3.4.5. Affected by this vulnerability is the function apriltag_detector_detect of the file apriltag.c. The manipulation leads to memory corruption. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The identifier of the patch is cfac2f5ce1ffe2de25967eb1ab80bc5d99fc1a61. It is suggested to install a patch to address this issue.
CVSS breakdown
CVSS 4.0
Attack Vector
Local
Attack Complexity
Low
Attack Requirements
None
Privileges Required
Low
User Interaction
None
Confidentiality (Vulnerable System)
None
Integrity (Vulnerable System)
None
Availability (Vulnerable System)
Low
Confidentiality (Subsequent System)
None
Integrity (Subsequent System)
None
Availability (Subsequent System)
None
E
Physical
CVSS 3.1
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
E
Physical
RL
O
RC
Changed
Affected products
- AprilRobotics / apriltag3.4.0 – 3.4.0
- AprilRobotics / apriltag3.4.1 – 3.4.1
- AprilRobotics / apriltag3.4.2 – 3.4.2
- AprilRobotics / apriltag3.4.3 – 3.4.3
- AprilRobotics / apriltag3.4.4 – 3.4.4
- AprilRobotics / apriltag3.4.5 – 3.4.5
References
- MISChttps://vuldb.com/?id.344994
- MISChttps://vuldb.com/?ctiid.344994
- MISChttps://vuldb.com/?submit.753162
- MISChttps://github.com/AprilRobotics/apriltag/issues/422
- MISChttps://github.com/AprilRobotics/apriltag/issues/422#issuecomment-3797661933
- MISChttps://github.com/oneafter/0120/blob/main/repro
- PATCHhttps://github.com/AprilRobotics/apriltag/commit/cfac2f5ce1ffe2de25967eb1ab80bc5d99fc1a61
- MISChttps://github.com/AprilRobotics/apriltag/