Vulnerability · Published Feb 19, 2024 · Assigned by GitHub_M
CVE-2023-50257Disconnect Vulnerability in RTPS Packets Used by SROS2
Critical 9.7
In plain English
A critical-severity improper access control in Fast-DDS from eProsima. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
eProsima Fast DDS (formerly Fast RTPS) is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Even with the application of SROS2, due to the issue where the data (`p[UD]`) and `guid` values used to disconnect between nodes are not encrypted, a vulnerability has been discovered where a malicious attacker can forcibly disconnect a Subscriber and can deny a Subscriber attempting to connect. Afterwards, if the attacker sends the packet for disconnecting, which is data (`p[UD]`), to the Global Data Space (`239.255.0.1:7400`) using the said Publisher ID, all the Subscribers (Listeners) connected to the Publisher (Talker) will not receive any data and their connection will be disconnected. Moreover, if this disconnection packet is sent continuously, the Subscribers (Listeners) trying to connect will not be able to do so. Since the initial commit of the `SecurityManager.cpp` code (`init`, `on_process_handshake`) on Nov 8, 2016, the Disconnect Vulnerability in RTPS Packets Used by SROS2 has been present prior to versions 2.13.0, 2.12.2, 2.11.3, 2.10.3, and 2.6.7.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | fastdds | no fix listed | DEBIAN-CVE-2023-50257 |
| Debian:13 | fastdds | 2.14.0+ds-2 | DEBIAN-CVE-2023-50257 |
| Ubuntu:24.04:LTS | fastdds | no fix listed | UBUNTU-CVE-2023-50257 |
Affected products (as reported)
Weakness: CWE-284 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-v5r6-8mvh-cp98 x_refsource_CONFIRM
- https://github.com/eProsima/Fast-DDS/commit/072cbc9d6a71d869a5cbed1873c0cdd6cf67cda4 x_refsource_MISC
- https://github.com/eProsima/Fast-DDS/commit/e1869863c06db7fbb366ae53760fbe6e754be026 x_refsource_MISC
- https://github.com/eProsima/Fast-DDS/commit/f07a0213e655202188840b864be4438ae1067a13 x_refsource_MISC
- https://github.com/eProsima/Fast-DDS/commit/f2e5ceae8fbea0a6c9445a366faaca0b98a8ef86 x_refsource_MISC