Summary

tattu_can contains an unbounded memcpy in its multi-frame assembly loop, allowing stack memory overwrite when crafted CAN frames are processed.
In deployments where tattu_can is enabled and running, a CAN-injection-capable attacker can trigger a crash (DoS) and memory corruption.

Details

The vulnerable code is in src/drivers/tattu_can/TattuCan.cpp (assembly logic around line 114):

• offset starts at 5.
• For each subsequent frame, payload_size = received_frame.payload_size - 1.
• Data is copied with:
  memcpy(((char *)&tattu_message) + offset, received_frame.payload, payload_size);
• There is no bounds check enforcing:
  offset + payload_size <= sizeof(Tattu12SBatteryMessage).

As a result, repeated crafted frames overflow the stack object tattu_message.

Operational condition:

• tattu_can must be compiled and started (CONFIG_DRIVERS_TATTU_CAN=y + tattu_can start).
• This is typically vendor/custom firmware specific (not commonly enabled in default upstream builds).

PoC

Integrated reproduction was performed with real PX4 runtime in Docker (not copied vulnerable snippet testing).

Reproduction files:

• security-lab/Dockerfile
• security-lab/container_run.sh
• security-lab/poc/tattu_can_can_injector.c
• security-lab/run.sh

Steps:

cd security-lab
./run.sh

Attachment

security-lab_20260311_200146.zip