Critical Denial of Service Vulnerability in FastDDS Package
Summary
DEBIAN-CVE-2024-30258: FastDDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Affects fastdds versions < 2.14.1+ds-1. Fixed in 2.14.1+ds-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FastDDS is a C++ implementation of the Data Distribution Service (DDS) standard defined by the Object Management Group (OMG). It facilitates real-time data exchange between distributed applications, making it essential for systems requiring high-performance communication. However, prior versions of FastDDS are susceptible to a vulnerability that can cause a subscriber to crash when processing malformed RTPS packets, potentially leading to a Denial of Service (DoS) attack.
Vulnerability Detail
The vulnerability arises when a publisher sends a malformed RTPS packet to a subscriber. In versions prior to 2.14.1, 2.13.5, 2.10.4, and 2.6.8, this can lead to a crash during the creation of a pthread, effectively causing any FastDDS process to become unresponsive. This issue poses a significant risk as it can be exploited remotely, allowing attackers to disrupt services that rely on FastDDS for communication.
How To Fix
Minimum fixed version
2.14.1+ds-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade fastddsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can implement network-level filtering to block malformed RTPS packets from reaching the FastDDS subscriber. This can be done using firewall rules or intrusion prevention systems to monitor and filter traffic.
Conclusion
The FastDDS package has a critical vulnerability that can lead to Denial of Service attacks through malformed RTPS packets. Users are strongly advised to update to the latest patched versions to safeguard their applications. Temporary workarounds are available, but updating is the most effective solution.
See every vulnerability recorded for fastdds →
FAQ
FastDDS is a C++ implementation of the DDS standard, enabling efficient real-time data communication between distributed applications.
The vulnerability allows an attacker to crash FastDDS processes by sending malformed RTPS packets, leading to potential Denial of Service.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Versions prior to 2.14.1, 2.13.5, 2.10.4, and 2.6.8 of FastDDS are affected by this vulnerability.
Implement network-level filtering to block malformed RTPS packets as a temporary workaround until you can update the package.
References
Related vulnerabilities
Recent vulnerabilities recorded for fastdds.
