oss-security - 83 bogus CVEs assigned to Robot Operating System (ROS)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <9faeb4d3-8b70-4be8-947c-f8e27be2df9d@canonical.com>
Date: Mon, 22 Apr 2024 18:52:39 -0500
From: Mark Esler <mark.esler@...onical.com>
To: oss-security@...ts.openwall.com
Cc: Yash Patel <yashpatelphd@...il.com>,
 "Dr. Parag H. Rughani" <parag.rughani@...u.ac.in>
Subject: 83 bogus CVEs assigned to Robot Operating System (ROS)

Yash Patel and Dr. Parag Rughani are credited as the discoverers for 
eighty-three recent CVEs affecting ROS 2 which the MITRE TL-Root CNA 
assigned.

All CVE descriptions are written at a very high, vague, level. No 
specifics or evidence has been provided to backup vulnerability claims.

Three CVEs (CVE-2023-33565, CVE-2023-33566, and CVE-2023-33567) 
reference the discoverer's 2022 ACM paper "Analyzing Security 
Vulnerability and Forensic Investigation of ROS2: A Case Study" [0]. The 
more technical portion of this paper was confirmed [1] to be based on a 
ROS 2 beginner tutorial [2]. The paper does not attribute ROS 2 
documentation.

Some CVEs claim that a security update will be forthcoming from the ROS 
2 development team [3]. Privately [4], ROS 2 core developers stated that 
they were not contacted and "came to the conclusion that [these CVEs] 
were likely not real security vulnerabilities.".

Certain CVEs describe unlikely situations. For instance, CVE-2024-30737 
claims: "A critical vulnerability has been identified in ROS Kinetic 
Kame, particularly in configurations with ROS_VERSION=1 and 
ROS_PYTHON_VERSION=3." [5]. ROS Kinetic Kame supports Python 2, not 
Python 3.

Frankly, all descriptions appear to be copy-pasted or generated to 
_sound_ like security issues. No evidence has been provided in the ACM 
paper or the 83 CVEs to suggest that vulnerabilities actually exist.

CVE revocation requests have been sent to MITRE and CVE descriptions 
have been appended with: "NOTE: this is disputed by multiple third 
parties who believe there was not reasonable evidence to determine the 
existence of a vulnerability."

The CVE IDs are: CVE-2023-33565, CVE-2023-33566, CVE-2023-33567, 
CVE-2023-51197, CVE-2023-51198, CVE-2023-51199, CVE-2023-51200, 
CVE-2023-51201, CVE-2023-51202, CVE-2023-51204, CVE-2023-51208, 
CVE-2024-29439, CVE-2024-29440, CVE-2024-29441, CVE-2024-29442, 
CVE-2024-29443, CVE-2024-29444, CVE-2024-29445, CVE-2024-29447, 
CVE-2024-29448, CVE-2024-29449, CVE-2024-29450, CVE-2024-29452, 
CVE-2024-29454, CVE-2024-29455, CVE-2024-30657, CVE-2024-30658, 
CVE-2024-30659, CVE-2024-30661, CVE-2024-30662, CVE-2024-30663, 
CVE-2024-30665, CVE-2024-30666, CVE-2024-30667, CVE-2024-30672, 
CVE-2024-30674, CVE-2024-30675, CVE-2024-30676, CVE-2024-30678, 
CVE-2024-30679, CVE-2024-30680, CVE-2024-30681, CVE-2024-30683, 
CVE-2024-30684, CVE-2024-30686, CVE-2024-30687, CVE-2024-30688, 
CVE-2024-30690, CVE-2024-30691, CVE-2024-30692, CVE-2024-30694, 
CVE-2024-30695, CVE-2024-30696, CVE-2024-30697, CVE-2024-30699, 
CVE-2024-30701, CVE-2024-30702, CVE-2024-30703, CVE-2024-30704, 
CVE-2024-30706, CVE-2024-30707, CVE-2024-30708, CVE-2024-30710, 
CVE-2024-30711, CVE-2024-30712, CVE-2024-30713, CVE-2024-30715, 
CVE-2024-30716, CVE-2024-30718, CVE-2024-30719, CVE-2024-30721, 
CVE-2024-30722, CVE-2024-30723, CVE-2024-30724, CVE-2024-30726, 
CVE-2024-30727, CVE-2024-30728, CVE-2024-30729, CVE-2024-30730, 
CVE-2024-30733, CVE-2024-30735, CVE-2024-30736, and CVE-2024-30737

Many thanks to Florencia Cabral Berenfus for her analysis of these claims!

Mark Esler

[0] https://dl.acm.org/doi/abs/10.1145/3573910.3573912
[1] https://github.com/yashpatelphd/CVE-2024-30737/issues/1
[2] 
https://docs.ros.org/en/foxy/Tutorials/Beginner-Client-Libraries/Writing-A-Simple-Py-Service-And-Client.html
[3] https://github.com/yashpatelphd/CVE-2023-33565
[4] message ID 
<CAE6X0kjYCMS4qRYP9Bohx88ue9ReedbPr=FFh+hNs+2RkOGeLg@...l.gmail.com>
[5] https://github.com/yashpatelphd/CVE-2024-30737

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.