Lucene search

[email protected]CVE-2023-50257

HistoryFeb 19, 2024 - 8:15 p.m.

CVE-2023-50257

2024-02-1920:15:45

CWE-284

[email protected]

web.nvd.nist.gov

eprosima fast dds

vulnerability

cve-2023-50257

sros2

data distribution service

object management group

remote code execution

unencrypted data

disconnect attack

denial of service

9.6 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

9.1 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

JSON

eProsima Fast DDS (formerly Fast RTPS) is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Even with the application of SROS2, due to the issue where the data (p[UD]) and guid values used to disconnect between nodes are not encrypted, a vulnerability has been discovered where a malicious attacker can forcibly disconnect a Subscriber and can deny a Subscriber attempting to connect. Afterwards, if the attacker sends the packet for disconnecting, which is data (p[UD]), to the Global Data Space (239.255.0.1:7400) using the said Publisher ID, all the Subscribers (Listeners) connected to the Publisher (Talker) will not receive any data and their connection will be disconnected. Moreover, if this disconnection packet is sent continuously, the Subscribers (Listeners) trying to connect will not be able to do so. Since the initial commit of the SecurityManager.cpp code (init, on_process_handshake) on Nov 8, 2016, the Disconnect Vulnerability in RTPS Packets Used by SROS2 has been present prior to versions 2.13.0, 2.12.2, 2.11.3, 2.10.3, and 2.6.7.

Affected configurations

Vulners

Node

eprosimafast_ddsRange2.12.0–2.12.2

eprosimafast_ddsRange2.11.0–2.11.3

eprosimafast_ddsRange2.7.0–2.10.3

eprosimafast_ddsRange<2.6.7

eprosimafast_ddsMatch2.10.2-2

eprosimafast_ddsMatch7.1.1-2

eprosimafast_ddsMatch2.6.6-1

eprosimafast_ddsMatch6.2.3.1

eprosimafast_ddsMatch2.3.6-6

eprosimafast_ddsMatch5.0.2-1

eprosimafast_ddsMatch2.1.4-1

eprosimafast_ddsMatch1.3.2-1

VendorProductVersionCPE
eprosimafast_dds*cpe:2.3:a:eprosima:fast_dds:*:*:*:*:*:*:*:*
eprosimafast_dds*cpe:2.3:a:eprosima:fast_dds:*:*:*:*:*:*:*:*
eprosimafast_dds*cpe:2.3:a:eprosima:fast_dds:*:*:*:*:*:*:*:*
eprosimafast_dds*cpe:2.3:a:eprosima:fast_dds:*:*:*:*:*:*:*:*
eprosimafast_dds2.10.2-2cpe:2.3:a:eprosima:fast_dds:2.10.2-2:*:*:*:*:*:*:*
eprosimafast_dds7.1.1-2cpe:2.3:a:eprosima:fast_dds:7.1.1-2:*:*:*:*:*:*:*
eprosimafast_dds2.6.6-1cpe:2.3:a:eprosima:fast_dds:2.6.6-1:*:*:*:*:*:*:*
eprosimafast_dds6.2.3.1cpe:2.3:a:eprosima:fast_dds:6.2.3.1:*:*:*:*:*:*:*
eprosimafast_dds2.3.6-6cpe:2.3:a:eprosima:fast_dds:2.3.6-6:*:*:*:*:*:*:*
eprosimafast_dds5.0.2-1cpe:2.3:a:eprosima:fast_dds:5.0.2-1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
eprosima	fast_dds	*	cpe:2.3:a:eprosima:fast_dds::::::::
eprosima	fast_dds	*	cpe:2.3:a:eprosima:fast_dds::::::::
eprosima	fast_dds	*	cpe:2.3:a:eprosima:fast_dds::::::::
eprosima	fast_dds	*	cpe:2.3:a:eprosima:fast_dds::::::::
eprosima	fast_dds	2.10.2-2	cpe:2.3:a:eprosima:fast_dds:2.10.2-2:::::::*
eprosima	fast_dds	7.1.1-2	cpe:2.3:a:eprosima:fast_dds:7.1.1-2:::::::*
eprosima	fast_dds	2.6.6-1	cpe:2.3:a:eprosima:fast_dds:2.6.6-1:::::::*
eprosima	fast_dds	6.2.3.1	cpe:2.3:a:eprosima:fast_dds:6.2.3.1:::::::*
eprosima	fast_dds	2.3.6-6	cpe:2.3:a:eprosima:fast_dds:2.3.6-6:::::::*
eprosima	fast_dds	5.0.2-1	cpe:2.3:a:eprosima:fast_dds:5.0.2-1:::::::*

Rows per page:

1-10 of 121

CNA Affected

[
  {
    "vendor": "eProsima",
    "product": "Fast-DDS",
    "versions": [
      {
        "version": ">= 2.12.0, < 2.12.2",
        "status": "affected"
      },
      {
        "version": ">= 2.11.0, < 2.11.3",
        "status": "affected"
      },
      {
        "version": ">= 2.7.0, < 2.10.3",
        "status": "affected"
      },
      {
        "version": "< 2.6.7",
        "status": "affected"
      },
      {
        "version": "FastDDS = 2.10.2-2",
        "status": "affected"
      },
      {
        "version": "RMW - FastDDS = 7.1.1-2",
        "status": "affected"
      },
      {
        "version": "FastDDS = 2.6.6-1",
        "status": "affected"
      },
      {
        "version": "RMW - FastDDS = 6.2.3.1",
        "status": "affected"
      },
      {
        "version": "FastDDS = 2.3.6-6",
        "status": "affected"
      },
      {
        "version": "RMW - FastDDS = 5.0.2-1",
        "status": "affected"
      },
      {
        "version": "FastDDS = 2.1.4-1",
        "status": "affected"
      },
      {
        "version": "RMW - FastDDS = 1.3.2-1",
        "status": "affected"
      }
    ]
  }
]

References

github.com/eProsima/Fast-DDS/commit/072cbc9d6a71d869a5cbed1873c0cdd6cf67cda4

github.com/eProsima/Fast-DDS/commit/e1869863c06db7fbb366ae53760fbe6e754be026

github.com/eProsima/Fast-DDS/commit/f07a0213e655202188840b864be4438ae1067a13

github.com/eProsima/Fast-DDS/commit/f2e5ceae8fbea0a6c9445a366faaca0b98a8ef86

github.com/eProsima/Fast-DDS/security/advisories/GHSA-v5r6-8mvh-cp98

9.6 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

9.1 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

JSON

Related for CVE-2023-50257

prion1 cvelist1 nvd1 osv1 debiancve1