CVE-2023-50716

What it actually does

An invalid DATA_FRAG Submessage triggers a use-after-free in the Inline_qos and SerializedPayload members of the ch object, causing a bad-free error that remotely terminates the Fast DDS process.

Why it matters to the business

Remote attackers can crash DDS-based distributed systems on the same network segment, disrupting real-time data exchange in affected Debian 12 deployments until systems are updated to the fixed package version 6.1.106-1.

How an attack unfolds

An attacker on the local network crafts a malformed DATA_FRAG Submessage and sends it to a vulnerable Fast DDS endpoint, triggering uninitialized memory release and process termination without authentication.

How to fix it

Upgrade eProsima Fast DDS to 2.13.0, 2.12.2, 2.11.3, 2.10.3, or 2.6.7 or later. On Debian 12 systems, install the fixed package version 6.1.106-1.

How to confirm the fix worked

Confirm the running Fast DDS version meets or exceeds the listed fixed releases and test packet handling with malformed DATA_FRAG submessages to verify absence of crashes.

Typical attack path

1. Locate exposed Fast DDS instances on the local network
2. Craft an invalid DATA_FRAG Submessage packet
3. Transmit the packet to the target process
4. Trigger the bad-free condition leading to remote termination

How to detect it

Review system and application logs for Fast DDS process crashes or bad-free errors correlated with inbound network traffic; inspect for anomalous DATA_FRAG submessages in packet captures.

What your security team should do

• Apply the Debian 12 package update to 6.1.106-1 on all affected hosts immediately
• Restrict network exposure of DDS endpoints to trusted segments only
• Monitor system logs for unexpected Fast DDS process terminations