CVE-2024-30916

What it actually does

Local attacker supplies a malicious max_samples value in the DurabilityService QoS configuration, triggering memory corruption or unbounded resource allocation that leads to denial of service and leakage of adjacent memory contents.

Why it matters to the business

Disruption of real-time data distribution services used in robotics, autonomous systems, and industrial control, resulting in operational downtime and potential exposure of internal configuration or sensor data.

How an attack unfolds

An attacker with local execution privileges identifies a process using the vulnerable FastDDS library, crafts a QoS policy containing an out-of-range max_samples value, and causes the DurabilityService component to dereference invalid memory or exhaust resources.

How to fix it

Upgrade eProsima FastDDS to a version later than 2.14.0 that contains the fix for the DurabilityService max_samples handling; rebuild and redeploy all dependent applications; restrict local access to systems running DDS participants until patches are applied.

How to confirm the fix worked

Confirm the running library version is newer than 2.14.0; attempt to reproduce the issue with a test program that supplies an extreme max_samples value and verify the process no longer crashes or leaks data; review QoS configuration files for non-default durability settings.

Typical attack path

1. Obtain local code execution on the target host
2. Locate FastDDS-based publisher or subscriber processes
3. Inject or modify a DurabilityService QoS profile with crafted max_samples
4. Trigger participant discovery or durability service initialization
5. Observe crash, hang, or memory disclosure

How to detect it

Search application and system logs for FastDDS crash reports or DurabilityService initialization failures; monitor for processes that terminate unexpectedly shortly after loading QoS profiles; inspect any captured configuration files or network discovery messages that contain extreme max_samples values.

What your security team should do

• Prioritize patching all FastDDS instances within the next maintenance window
• Apply host-based controls to limit which users can modify QoS policies or launch DDS applications
• Add runtime monitoring for abnormal termination of FastDDS processes
• Review downstream dependencies and update any packages that embed the vulnerable library