CVE-2024-30259

FastDDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to versions 2.14.1, 2.13.5, 2.10.4, and 2.6.8, when a publisher serves malformed `RTPS` packet, heap buffer overflow occurs on the subscriber. This can remotely crash any Fast-DDS process, potentially leading to a DOS attack. Versions 2.14.1, 2.13.5, 2.10.4, and 2.6.8 contain a patch for the issue.

CVSS v3 8.2 HIGH

8.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://drive.google.com/file/d/1Y2bGvP3UIOJCLh_XEURLdhrM2Sznlvlp/view?usp=sharing	Exploit
https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-qcj9-939p-p662	Exploit Vendor Advisory
https://vimeo.com/907641887?share=copy	Exploit
https://drive.google.com/file/d/1Y2bGvP3UIOJCLh_XEURLdhrM2Sznlvlp/view?usp=sharing	Exploit
https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-qcj9-939p-p662	Exploit Vendor Advisory
https://vimeo.com/907641887?share=copy	Exploit

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:eprosima:fast_dds::::::::
	cpe:2.3:a:eprosima:fast_dds::::::::
	cpe:2.3:a:eprosima:fast_dds::::::::
	cpe:2.3:a:eprosima:fast_dds:2.14.0:::::::*

History

No history.

Information

Published : 2024-05-14 15:22

Updated : 2025-01-27 18:16

NVD link : CVE-2024-30259

Mitre link : CVE-2024-30259

CVE.ORG link : CVE-2024-30259

JSON object : View

Products Affected

eprosima

fast_dds

CWE

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CWE-122

Heap-based Buffer Overflow

CWE-787

Out-of-bounds Write

{"id": "CVE-2024-30259", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-05-14T15:22:15.967", "references": [{"url": "https://drive.google.com/file/d/1Y2bGvP3UIOJCLh_XEURLdhrM2Sznlvlp/view?usp=sharing", "tags": ["Exploit"], "source": "[email protected]"}, {"url": "https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-qcj9-939p-p662", "tags": ["Exploit", "Vendor Advisory"], "source": "[email protected]"}, {"url": "https://vimeo.com/907641887?share=copy", "tags": ["Exploit"], "source": "[email protected]"}, {"url": "https://drive.google.com/file/d/1Y2bGvP3UIOJCLh_XEURLdhrM2Sznlvlp/view?usp=sharing", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-qcj9-939p-p662", "tags": ["Exploit", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://vimeo.com/907641887?share=copy", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-120"}, {"lang": "en", "value": "CWE-122"}]}, {"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "FastDDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to versions 2.14.1, 2.13.5, 2.10.4, and 2.6.8, when a publisher serves malformed `RTPS` packet, heap buffer overflow occurs on the subscriber. This can remotely crash any Fast-DDS process, potentially leading to a DOS attack. Versions 2.14.1, 2.13.5, 2.10.4, and 2.6.8 contain a patch for the issue.\n"}, {"lang": "es", "value": "FastDDS es una implementaci\u00f3n en C++ del est\u00e1ndar DDS (Servicio de distribuci\u00f3n de datos) de OMG (Object Management Group). Antes de las versiones 2.14.1, 2.13.5, 2.10.4 y 2.6.8, cuando un editor entrega un paquete \"RTPS\" con formato incorrecto, se produce un desbordamiento de b\u00fafer de almacenamiento din\u00e1mico en el suscriptor. Esto puede bloquear de forma remota cualquier proceso Fast-DDS, lo que podr\u00eda provocar un ataque de DOS. Las versiones 2.14.1, 2.13.5, 2.10.4 y 2.6.8 contienen un parche para el problema."}], "lastModified": "2025-01-27T18:16:00.440", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:eprosima:fast_dds:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "25329FD4-C1B1-4531-9D30-6ED8E1962020", "versionEndExcluding": "2.6.8"}, {"criteria": "cpe:2.3:a:eprosima:fast_dds:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "853DA35B-E938-4744-9342-EB4057ED7FC7", "versionEndExcluding": "2.10.4", "versionStartIncluding": "2.10.0"}, {"criteria": "cpe:2.3:a:eprosima:fast_dds:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "34FCC01E-72D0-4CF2-A849-C869BB9CA898", "versionEndExcluding": "2.13.5", "versionStartIncluding": "2.13.0"}, {"criteria": "cpe:2.3:a:eprosima:fast_dds:2.14.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E1186C20-32E4-45D1-8CBA-63BFA962441B"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}