eProsima Fast-DDS up to 2.6.6/2.10.2/2.11.2/2.12.1 DATA_FRAG Submessage use after free

Summaryinfo

A vulnerability categorized as very critical has been discovered in eProsima Fast-DDS up to 2.6.6/2.10.2/2.11.2/2.12.1. Affected is an unknown function of the component DATA_FRAG Submessage Handler. Such manipulation leads to use after free. This vulnerability is traded as CVE-2023-50716. Access to the local network is required for this attack to succeed. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in eProsima Fast-DDS up to 2.6.6/2.10.2/2.11.2/2.12.1. It has been rated as very critical. Affected by this issue is an unknown functionality of the component DATA_FRAG Submessage Handler. The manipulation with an unknown input leads to a use after free vulnerability. Using CWE to declare the problem leads to CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. Impacted is confidentiality, integrity, and availability. CVE summarizes:

eProsima Fast DDS (formerly Fast RTPS) is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.13.0, 2.12.2, 2.11.3, 2.10.3, and 2.6.7, an invalid DATA_FRAG Submessage causes a bad-free error, and the Fast-DDS process can be remotely terminated. If an invalid Data_Frag packet is sent, the `Inline_qos, SerializedPayload` member of object `ch` will attempt to release memory without initialization, resulting in a 'bad-free' error. Versions 2.13.0, 2.12.2, 2.11.3, 2.10.2, and 2.6.7 fix this issue.

The weakness was shared 03/06/2024. The advisory is available at github.com. This vulnerability is handled as CVE-2023-50716 since 12/11/2023. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 03/06/2024).

Upgrading eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• eProsima

Name

• Fast-DDS

Version

• 2.6.0
• 2.6.1
• 2.6.2
• 2.6.3
• 2.6.4
• 2.6.5
• 2.6.6
• 2.10.0
• 2.10.1
• 2.10.2
• 2.11.0
• 2.11.1
• 2.11.2
• 2.12.0
• 2.12.1

Website

• Product: https://github.com/eProsima/Fast-DDS/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion