THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Zendesk (Helpdesk and Chat)

Ok

PUBLISHED

CVE-2024-30258

FastDDS crash when publisher send malformed packet

Reserved:2024-03-26
Published:2024-05-13
Updated:2024-05-13

Description

FastDDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to versions 2.14.1, 2.13.5, 2.10.4, and 2.6.8, when a publisher serves a malformed `RTPS` packet, the subscriber crashes when creating `pthread`. This can remotely crash any Fast-DDS process, potentially leading to a DOS attack. Versions 2.14.1, 2.13.5, 2.10.4, and 2.6.8 contain a patch for the issue.



HIGH: 8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Problem types

CWE-20: Improper Input Validation

Product status

= 2.14.0
affected

>= 2.13.0, < 2.13.5
affected

>= 2.10.0, < 2.10.4
affected

< 2.6.8
affected

References

https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-53xw-465j-rxfh

https://github.com/eProsima/Fast-DDS/commit/65236f93e9c4ea3ff9a49fba4dfd9e43eb94037b

https://drive.google.com/file/d/19W5UC52hPnAqVq_boZWO45d1TJ4WoCSh/view?usp=sharing

cve.org CVE-2024-30258

nvd.nist.gov CVE-2024-30258

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-30258