PT-2023-7345 · Fastdds · Fastdds

Squizz617 · Published 2023-10-16 · Updated 2023-11-28 · CVE-2023-42459

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:C

Name of the Vulnerable Software and Affected Versions Fast DDS versions prior to 2.12.0 Fast DDS versions prior to 2.11.3 Fast DDS versions prior to 2.10.3 Fast DDS versions prior to 2.6.7

Description Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). In affected versions, specific DATA submessages can be sent to a discovery locator, which may trigger a free error, potentially allowing a remote attacker to crash any Fast-DDS process. The call to free() could potentially leave the pointer in the attacker's control, which could lead to a double free.

Recommendations For versions prior to 2.12.0, upgrade to version 2.12.0 or later. For versions prior to 2.11.3, upgrade to version 2.11.3 or later. For versions prior to 2.10.3, upgrade to version 2.10.3 or later. For versions prior to 2.6.7, upgrade to version 2.6.7 or later.

Exploit

Fix

Use After Free

Double Free

Weakness Enumeration

CWE-416

CWE-590

CWE-415

Related Identifiers

BDU:2023-08376

CVE-2023-42459

DSA-5568-1

GHSA-GQ8G-FJ58-22GM

Affected Products

Fastdds

References · 20

• 🔥 https://github.com/eProsima/Fast-DDS/issues/3207 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/42xxx/CVE-2023-42459.json · Exploit
• https://github.com/eProsima/Fast-DDS/pull/3824 · Patch
• https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-gq8g-fj58-22gm · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-42459 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-42459 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-42459 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-42459 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5568-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08376 · Security Note
• https://osv.dev/vulnerability/CVE-2023-42459 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-42459 · Security Note
• https://debian.org/security/2023/dsa-5568 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-42459 · Vendor Advisory
• https://github.com/eProsima/Fast-DDS/commit/1e978c6f3d0ca1df6b323b37fd4902b0762ececb · Note