Vulnerability · Published May 13, 2024 · Assigned by GitHub_M
CVE-2024-30258FastDDS crash when publisher send malformed packet
High 8.2
In plain English
A high-severity improper input validation in Fast-DDS from eProsima. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
FastDDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to versions 2.14.1, 2.13.5, 2.10.4, and 2.6.8, when a publisher serves a malformed `RTPS` packet, the subscriber crashes when creating `pthread`. This can remotely crash any Fast-DDS process, potentially leading to a DOS attack. Versions 2.14.1, 2.13.5, 2.10.4, and 2.6.8 contain a patch for the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | fastdds | no fix listed | DEBIAN-CVE-2024-30258 |
| Debian:13 | fastdds | 2.14.1+ds-1 | DEBIAN-CVE-2024-30258 |
| Ubuntu:24.04:LTS | fastdds | no fix listed | UBUNTU-CVE-2024-30258 |
Affected products (as reported)
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H