CVE-2024-28231

2024-03-2020:15:08

CWE-122

[email protected]

web.nvd.nist.gov

eprosima

fast dds

cve-2024-28231

heap overflow

integer overflow

nvd

9.6 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

9.3 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.0%

JSON

eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.14.0, 2.13.4, 2.12.3, 2.10.4, and 2.6.8, manipulated DATA Submessage can cause a heap overflow error in the Fast-DDS process, causing the process to be terminated remotely. Additionally, the payload_size in the DATA Submessage packet is declared as uint32_t. When a negative number, such as -1, is input into this variable, it results in an Integer Overflow (for example, -1 gets converted to 0xFFFFFFFF). This eventually leads to a heap-buffer-overflow, causing the program to terminate. Versions 2.14.0, 2.13.4, 2.12.3, 2.10.4, and 2.6.8 contain a fix for this issue.

Affected configurations

Vulners

Node

eprosimafast_ddsRange<2.6.8

eprosimafast_ddsRange2.7.0–2.10.4

eprosimafast_ddsRange2.11.0–2.12.2

eprosimafast_ddsRange2.13.0–2.13.4

VendorProductVersionCPE
eprosimafast_dds*cpe:2.3:a:eprosima:fast_dds:*:*:*:*:*:*:*:*
eprosimafast_dds*cpe:2.3:a:eprosima:fast_dds:*:*:*:*:*:*:*:*
eprosimafast_dds*cpe:2.3:a:eprosima:fast_dds:*:*:*:*:*:*:*:*
eprosimafast_dds*cpe:2.3:a:eprosima:fast_dds:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
eprosima	fast_dds	*	cpe:2.3:a:eprosima:fast_dds::::::::
eprosima	fast_dds	*	cpe:2.3:a:eprosima:fast_dds::::::::
eprosima	fast_dds	*	cpe:2.3:a:eprosima:fast_dds::::::::
eprosima	fast_dds	*	cpe:2.3:a:eprosima:fast_dds::::::::

CNA Affected

[
  {
    "vendor": "eProsima",
    "product": "Fast-DDS",
    "versions": [
      {
        "version": "< 2.6.8",
        "status": "affected"
      },
      {
        "version": ">= 2.7.0, < 2.10.4",
        "status": "affected"
      },
      {
        "version": ">= 2.11.0, < 2.12.2",
        "status": "affected"
      },
      {
        "version": ">= 2.13.0, < 2.13.4",
        "status": "affected"
      }
    ]
  }
]