Heap-based buffer overflow in Fast DDS - CVE-2023-39946

Vulnerability identifier: #VU79821

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-39946

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in eprosima::fastdds::dds::ParameterPropertyList_t::push_back_helper() function. A remote attacker can send an overly long CDR string to the discovery multicast port, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Fast DDS
Debian Linux
Ubuntu
fastdds-tools (Ubuntu package)
libfastrtps2.5 (Ubuntu package)
fastdds (Debian package)
libfastrtps2.9 (Ubuntu package)

Install updates from vendor's website.

Fast DDS - addressed in versions 2.6.6, 2.9.2, 2.10.2, 2.11.1
fastdds-tools (Ubuntu package) - addressed in versions Ubuntu Pro, 2.9.1+ds-1ubuntu0.1
libfastrtps2.5 (Ubuntu package) - update to Ubuntu Pro
fastdds (Debian package) - addressed in versions 2.1.0+ds-9+deb11u1, 2.9.1+ds-1+deb12u1
libfastrtps2.9 (Ubuntu package) - update to 2.9.1+ds-1ubuntu0.1

• https://github.com/eProsima/Fast-DDS/commit/349227005827e8a67a0406b823138b5068cc47dc
• https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-j297-rg6j-m7hx
• https://www.debian.org/security/2023/dsa-5481

• Multiple vulnerabilities in eProsima Fast DDS
• Debian update for fastdds
• Ubuntu update for fastdds