CVE-2023-39946: high-severity vulnerability in eProsima Fast-DDS
Heap overflow in push_back_helper due to a CDR message
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.2epss 0.9%
eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.11.1, 2.10.2, 2.9.2, and 2.6.6, heap can be overflowed by providing a PID_PROPERTY_LIST parameter that contains a CDR string with length larger than the size of actual content. In `eprosima::fastdds::dds::ParameterPropertyList_t::push_back_helper`, `memcpy` is called to first copy the octet'ized length and then to copy the data into `properties_.data`. At the second memcpy, both `data` and `size` can be controlled by anyone that sends the CDR string to the discovery multicast port. This can remotely crash any Fast-DDS process. Versions 2.11.1, 2.10.2, 2.9.2, and 2.6.6 contain a patch for this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Affected products
eProsima · Fast-DDSRelated CVEs — eProsima Fast-DDS
In the same product, most dangerous first.
CVE-2023-39949HIGHImproper validation of sequence numbers leading to remotely reachable assertion failureEPSS 1.0%CVE-2023-39948HIGHUncaught fastcdr exception (Unexpected CDR type received) crashing fastddsEPSS 1.0%CVE-2023-39534HIGHMalformed GAP submessage triggers assertion failureEPSS 1.0%CVE-2023-42459HIGHMalformed DATA submessage leads to bad-free error in Fast-DDSEPSS 1.0%CVE-2023-39947HIGHAnother heap overflow in push_back_helperEPSS 1.0%CVE-2024-28231CRITICALManipulated DATA Submessage causes a heap-buffer-overflow errorEPSS 0.9%