Racing PX4 - Memory Safety and Timing Vulnerabilities

This talk examines PX4, an open-source flight stack used in drones ranging from hobby builds to military UAVs. The speaker covers three parts of it: the uORB publish-subscribe middleware, the MAVLink ground-station protocol, and the MAVLink logging subsystem. Using a restaurant-order analogy, the talk shows how a single bug in one topic can spread to other modules and disrupt the whole system.

Two stack-based overflows, both published in March 2026, are walked through in detail. One comes from an unbounded scanf in the MAVLink log handler, triggered by a crafted directory path sent over MAVLink FTP followed by a log list request. The other is a variable-length stack array in a uORB subscriber that sizes allocations from an unchecked payload length. Each case includes an AddressSanitizer report and suggested fixes such as bounded parsing and fixed-size buffers.

The main original finding is a race condition in the logger. The stop function deletes a global instance, while the acknowledgment handler only checks that the pointer exists, so stale acknowledgments from an earlier session are accepted in a new one. Repeated start and stop commands sent over UDP cause packet-loss reporting to become unreliable, saturate the queue, and drop commands for key modules. Proposed mitigations include session identifiers, rate limiting on logger toggles, and an active-session check before acknowledgments are processed.