CVE-2024-30259
FastDDS heap buffer overflow when publisher sends malformed packet
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
FastDDS heap buffer overflow when publisher sends malformed packet
| Assigner | GitHub_M |
| Reserved | 2024-03-26 |
| Published | 2024-05-13 |
| Updated | 2024-08-02 |
FastDDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to versions 2.14.1, 2.13.5, 2.10.4, and 2.6.8, when a publisher serves malformed `RTPS` packet, heap buffer overflow occurs on the subscriber. This can remotely crash any Fast-DDS process, potentially leading to a DOS attack. Versions 2.14.1, 2.13.5, 2.10.4, and 2.6.8 contain a patch for the issue.
| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H |
CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CWE-122: Heap-based Buffer Overflow
https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-qcj9-939p-p662
https://drive.google.com/file/d/1Y2bGvP3UIOJCLh_XEURLdhrM2Sznlvlp/view?usp=sharing
https://vimeo.com/907641887?share=copy
