CVE-2023-42459

Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). In affected versions specific DATA submessages can be sent to a discovery locator which may trigger a free error. This can remotely crash any Fast-DDS process. The call to free() could potentially leave the pointer in the attackers control which could lead to a double free. This issue has been addressed in versions 2.12.0, 2.11.3, 2.10.3, and 2.6.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/eProsima/Fast-DDS/issues/3207	Exploit Issue Tracking
https://github.com/eProsima/Fast-DDS/pull/3824	Patch
https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-gq8g-fj58-22gm	Vendor Advisory
https://www.debian.org/security/2023/dsa-5568

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:eprosima:fast_dds::::::::
	cpe:2.3:a:eprosima:fast_dds::::::::
	cpe:2.3:a:eprosima:fast_dds::::::::

History

No history.

Information

Published : 2023-10-16 21:15

Updated : 2023-11-28 01:15

NVD link : CVE-2023-42459

Mitre link : CVE-2023-42459

CVE.ORG link : CVE-2023-42459

JSON object : View

Products Affected

eprosima

fast_dds

CWE

CWE-415

Double Free

CWE-416

Use After Free

CWE-590

Free of Memory not on the Heap

{"id": "CVE-2023-42459", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 3.9}]}, "published": "2023-10-16T21:15:10.923", "references": [{"url": "https://github.com/eProsima/Fast-DDS/issues/3207", "tags": ["Exploit", "Issue Tracking"], "source": "security-advisories@github.com"}, {"url": "https://github.com/eProsima/Fast-DDS/pull/3824", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-gq8g-fj58-22gm", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://www.debian.org/security/2023/dsa-5568", "source": "security-advisories@github.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-415"}, {"lang": "en", "value": "CWE-416"}, {"lang": "en", "value": "CWE-590"}]}], "descriptions": [{"lang": "en", "value": "Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). In affected versions specific DATA submessages can be sent to a discovery locator which may trigger a free error. This can remotely crash any Fast-DDS process. The call to free() could potentially leave the pointer in the attackers control which could lead to a double free. This issue has been addressed in versions 2.12.0, 2.11.3, 2.10.3, and 2.6.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.\n"}, {"lang": "es", "value": "Fast DDS es una implementaci\u00f3n en C++ del est\u00e1ndar DDS (Servicio de Distribuci\u00f3n de Datos) de OMG (Object Management Group). En las versiones afectadas, se pueden enviar submensajes de DATOS espec\u00edficos a un localizador de descubrimiento que puede provocar un error free. Esto puede bloquear de forma remota cualquier proceso Fast-DDS. La llamada a free() podr\u00eda potencialmente dejar el puntero en el control del atacante, lo que podr\u00eda conducir a un doble free. Este problema se solucion\u00f3 en las versiones 2.12.0, 2.11.3, 2.10.3 y 2.6.7. Se recomienda a los usuarios que actualicen. No se conocen workarounds para esta vulnerabilidad."}], "lastModified": "2023-11-28T01:15:07.107", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:eprosima:fast_dds:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B6D03699-CB0F-4A0D-BDB6-1007A9D669EE", "versionEndExcluding": "2.6.7"}, {"criteria": "cpe:2.3:a:eprosima:fast_dds:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C24C066C-7447-4106-A5BA-EEE3EF108404", "versionEndExcluding": "2.10.3", "versionStartIncluding": "2.10.0"}, {"criteria": "cpe:2.3:a:eprosima:fast_dds:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1ACA728D-A75E-4969-A636-633E0460FED6", "versionEndIncluding": "2.11.1", "versionStartIncluding": "2.11.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}