eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.14.0, 2.13.4, 2.12.3, 2.10.4, and 2.6.8, manipulated DATA Submessage can cause a heap overflow error in the Fast-DDS process, causing the process to be terminated remotely. Additionally, the payload_size in the DATA Submessage packet is declared as uint32_t. When a negative number, such as -1, is input into this variable, it results in an Integer Overflow (for example, -1 gets converted to 0xFFFFFFFF). This eventually leads to a heap-buffer-overflow, causing the program to terminate. Versions 2.14.0, 2.13.4, 2.12.3, 2.10.4, and 2.6.8 contain a fix for this issue.
An attacker sends a crafted DATA Submessage packet with a negative value in the payload_size field (e.g., -1), which is declared as uint32_t type. The negative value is converted to a very large unsigned number (e.g., -1 → 0xFFFFFFFF), leading to integer overflow. This results in an attempt to write data outside the bounds of the allocated heap buffer (heap-buffer-overflow), which ends in a process crash. The attack can be conducted remotely over a local network without authentication.
An attacker can remotely trigger a crash of the Fast DDS process (Denial of Service). In the context of heap buffer overflow vulnerability (CWE-122, CWE-787), the possibility of arbitrary code execution within the process space cannot be excluded.
eprosima Fast DDS must be updated to version 2.14.0, 2.13.4, 2.12.3, 2.10.4 or 2.6.8, which contain a fix for this vulnerability. Details are available in the vendor's repository on GitHub (commit 355706386f4af9ce74125eeec3c449b06113112b).
eprosima Fast DDS in versions prior to 2.14.0, 2.13.4, 2.12.3, 2.10.4 and 2.6.8
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HEprosima Fast Dds
APPEprosima< 2.6.82.7.0 – 2.10.4 (excl.)2.11.0 – 2.12.3 (excl.)2.13.0 – 2.13.4 (excl.)
Related vulnerabilities
eProsima Fast-DDS: błędna walidacja odwołania certyfikatów/tokenów
eProsima Fast DDS — use-after-free przez nieprawidłowy pakiet DATA_FRAG
eProsima Fast DDS — podatność rozłączenia subskrybentów RTPS w SROS2
eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object M...
eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object M...