Cloudanix VulnDB

CVE-2023-39946

High · 7.5

CVSS

7.5

EPSS

0.9%

Published

Aug 11, 2023

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in a data communication library allows remote attackers to crash connected systems by sending specially crafted messages.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

A heap buffer overflow occurs when a PID_PROPERTY_LIST parameter with a CDR string longer than its content is processed, leading to memcpy of attacker-controlled data and size into internal property storage, resulting in remote denial of service via process crash.

Why it matters to the business

Attackers can remotely disrupt DDS-based communication systems, causing service outages without authentication.

How an attack unfolds

An attacker sends a crafted discovery packet containing an oversized PID_PROPERTY_LIST to the multicast port, triggering the vulnerable push_back_helper function during parameter processing.

How to fix it

Upgrade eprosima/fast-dds to versions 2.11.1, 2.10.2, 2.9.2, or 2.6.6 or later, specifically applying the patch in commit cffaa679ec8cd9c84b4d5b3fe1e3c22974d63be0.

How to confirm the fix worked

Verify the software version is at or above the fixed releases and test that oversized parameters are properly rejected without crashing.

Typical attack path

  1. Identify exposed Fast DDS discovery multicast port
  2. Craft malicious CDR string in PID_PROPERTY_LIST with controlled length and data
  3. Send packet to trigger memcpy overflow
  4. Cause heap corruption leading to crash

How to detect it

Look for crashes in Fast DDS processes and unusual packets on the discovery multicast port; review logs for parameter processing errors.

What your security team should do

  • Apply the available patches immediately
  • Restrict access to discovery ports where possible
  • Monitor for anomalous traffic on DDS ports

The record

eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.11.1, 2.10.2, 2.9.2, and 2.6.6, heap can be overflowed by providing a PID_PROPERTY_LIST parameter that contains a CDR string with length larger than the size of actual content. In `eprosima::fastdds::dds::ParameterPropertyList_t::push_back_helper`, `memcpy` is called to first copy the octet'ized length and then to copy the data into `properties_.data`. At the second memcpy, both `data` and `size` can be controlled by anyone that sends the CDR string to the discovery multicast port. This can remotely crash any Fast-DDS process. Versions 2.11.1, 2.10.2, 2.9.2, and 2.6.6 contain a patch for this issue.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 fastdds 0 2.1.0+ds-9+deb11u1
Debian:12 fastdds 0 2.9.1+ds-1+deb12u1
Debian:13 fastdds 0 2.10.1+ds-3
Ubuntu:22.04:LTS fastdds 0 No fix
Ubuntu:24.04:LTS fastdds 0 2.10.1+ds-3
Ubuntu:Pro:22.04:LTS fastdds 0 2.5.0+ds-3ubuntu0.1~esm1

Related vulnerabilities