CVE-2023-50257

The vulnerability results from the fact that RTPS disconnection packets (data `p[UD]`) and `guid` values used for disconnecting nodes are not encrypted, even when SROS2 is active. An attacker can impersonate an existing Publisher (Talker) by using its ID and send a forged disconnection packet to the Global Data Space multicast address (`239.255.0.1:7400`). As a result, all Subscribers (Listeners) connected to that Publisher are disconnected and stop receiving data. If the attacker sends such packets continuously, new attempts by Subscribers to connect are effectively blocked (denial of service).

An attacker can permanently deprive Subscribers of the ability to receive data and prevent new connections from being established, leading to denial of service (DoS) across the entire network of DDS nodes. In critical environments (e.g., ROS 2 robotic systems), this could result in loss of control over physical devices.

Update eProsima Fast DDS to version 2.13.0, 2.12.2, 2.11.3, 2.10.3, or 2.6.7 (depending on the branch being used). Patches are available in the project repository on GitHub (commits: 072cbc9d, e1869863, f07a0213, f2e5ceae). Network segmentation should also be considered to restrict access to the multicast address `239.255.0.1:7400` to trusted nodes only.

eProsima Fast DDS in all versions earlier than 2.13.0, 2.12.2, 2.11.3, 2.10.3, and 2.6.7 — the vulnerability has been present since November 8, 2016 (from the first commit of the SecurityManager.cpp file).