Critical Vulnerability in Fast DDS Package: Remote Crash Risk Due to Uncaught Exception
Summary
UBUNTU-CVE-2023-39948: eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Affects fastdds versions 2.1.0+ds-9 – 2.5.0+ds-3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
eprosima Fast DDS is a C++ implementation of the Data Distribution Service (DDS) standard defined by the Object Management Group. It facilitates real-time data exchange between applications in a distributed system. The package is widely used in various industries for its efficiency and reliability in handling data streams. However, prior to versions 2.10.0 and 2.6.5, Fast DDS was susceptible to a critical vulnerability that could lead to remote crashes, compromising system stability.
Vulnerability Detail
The vulnerability arises from an uncaught BadParamException thrown by Fast CDR within Fast DDS. This issue can be exploited remotely, allowing an attacker to crash any Fast DDS process. The lack of exception handling in earlier versions poses a significant risk, as it can disrupt services relying on Fast DDS for data distribution. The vulnerability has been assigned a CVSS score of 7.5, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can implement additional monitoring and logging around Fast DDS processes to detect abnormal behavior. However, the most effective solution is to update to the patched versions as mentioned above.
Conclusion
The Fast DDS package has a critical vulnerability that can lead to remote crashes due to an uncaught exception. It is crucial for users to update to the patched versions to ensure system stability and security. Utilizing tools like Vulert can further enhance vulnerability management.
See every vulnerability recorded for fastdds →
FAQ
The vulnerability is due to an uncaught exception that can lead to remote crashes of Fast DDS processes.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
Failure to address this vulnerability may result in service disruptions and crashes, affecting applications that rely on Fast DDS for data distribution.
Yes, you should upgrade to version 2.10.0 or 2.6.5 or later to mitigate the vulnerability.
Vulert monitors and alerts for open-source vulnerabilities in software using a manifest file. It provides real-time insights into potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for fastdds.
