PT-2023-4900 · Eprosima+2 · Eprosima Fast Dds+2

Squizz617 · Published 2023-08-11 · Updated 2023-08-24 · CVE-2023-39948

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions eprosima Fast DDS versions prior to 2.10.0 and 2.6.5

Description The issue is related to insufficient handling of exceptional states in the eprosima Fast DDS library, which is a C++ implementation of the Data Distribution Service standard of the Object Management Group. This can allow a remote attacker to cause a denial of service by crashing any Fast DDS process. The BadParamException thrown by Fast CDR is not caught in Fast DDS, leading to this vulnerability.

Recommendations To resolve the issue, update to version 2.10.0 or 2.6.5, as these versions contain a patch for this issue. As a temporary workaround, consider implementing exception handling for the BadParamException thrown by Fast CDR to prevent remote crashes of Fast DDS processes.

Exploit

Fix

Weakness Enumeration

CWE-248

Related Identifiers

BDU:2023-05393

CVE-2023-39948

DSA-5481-1

GHSA-X9PJ-VRGF-F68F

USN-6306-1

Affected Products

Linuxmint

Ubuntu

Eprosima Fast Dds

References · 26

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39948.json · Exploit
• https://ubuntu.com/security/CVE-2023-39946 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-39948 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-39948 · Security Note
• https://cve.org/CVERecord?id=CVE-2023-39948 · Security Note
• https://ubuntu.com/security/notices/USN-6306-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-39949 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-39947 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-39948 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6306-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-39948 · Vendor Advisory
• https://debian.org/security/2023/dsa-5481 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-39948 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05393 · Security Note
• https://osv.dev/vulnerability/DSA-5481-1 · Vendor Advisory