FastDDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to versions 2.14.1, 2.13.5, 2.10.4, and 2.6.8, when a publisher serves malformed `RTPS` packet, heap buffer overflow occurs on the subscriber. This can remotely crash any Fast-DDS process, potentially leading to a DOS attack. Versions 2.14.1, 2.13.5, 2.10.4, and 2.6.8 contain a patch for the issue.
References
| Link | Resource |
|---|---|
| https://drive.google.com/file/d/1Y2bGvP3UIOJCLh_XEURLdhrM2Sznlvlp/view?usp=sharing | Exploit |
| https://drive.google.com/file/d/1Y2bGvP3UIOJCLh_XEURLdhrM2Sznlvlp/view?usp=sharing | Exploit |
| https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-qcj9-939p-p662 | Exploit Vendor Advisory |
| https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-qcj9-939p-p662 | Exploit Vendor Advisory |
| https://vimeo.com/907641887?share=copy | Exploit |
| https://vimeo.com/907641887?share=copy | Exploit |
Configurations
Configuration 1 (hide)
|
History
27 Jan 2025, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-787 | |
| CPE | cpe:2.3:a:eprosima:fast_dds:*:*:*:*:*:*:*:* cpe:2.3:a:eprosima:fast_dds:2.14.0:*:*:*:*:*:*:* |
|
| First Time |
Eprosima
Eprosima fast Dds |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| References | () https://drive.google.com/file/d/1Y2bGvP3UIOJCLh_XEURLdhrM2Sznlvlp/view?usp=sharing - Exploit | |
| References | () https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-qcj9-939p-p662 - Exploit, Vendor Advisory | |
| References | () https://vimeo.com/907641887?share=copy - Exploit |
14 May 2024, 16:13
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-05-14 15:22
Updated : 2025-01-27 18:16
NVD link : CVE-2024-30259
Mitre link : CVE-2024-30259
JSON object : View
Products Affected
eprosima
- fast_dds
CWE
CWE-787
Out-of-bounds Write