CVE-2023-42459

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-42459
Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). In affected versions specific DATA submessages can be sent to a discovery locator which may trigger a free error. This can remotely crash any Fast-DDS process. The call to free() could potentially leave the pointer in the attackers control which could lead to a double free. This issue has been addressed in versions 2.12.0, 2.11.3, 2.10.3, and 2.6.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

8.6 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/eProsima/Fast-DDS/issues/3207 Exploit Issue Tracking
https://github.com/eProsima/Fast-DDS/pull/3824 Patch
https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-gq8g-fj58-22gm Vendor Advisory
https://www.debian.org/security/2023/dsa-5568
https://github.com/eProsima/Fast-DDS/issues/3207 Exploit Issue Tracking
https://github.com/eProsima/Fast-DDS/pull/3824 Patch
https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-gq8g-fj58-22gm Vendor Advisory
https://www.debian.org/security/2023/dsa-5568
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:eprosima:fast_dds:*:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:*:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:*:*:*:*:*:*:*:*
History

13 Feb 2025, 17:17

Type Values Removed Values Added
Summary (en) Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). In affected versions specific DATA submessages can be sent to a discovery locator which may trigger a free error. This can remotely crash any Fast-DDS process. The call to free() could potentially leave the pointer in the attackers control which could lead to a double free. This issue has been addressed in versions 2.12.0, 2.11.3, 2.10.3, and 2.6.7. Users are advised to upgrade. There are no known workarounds for this vulnerability. (en) Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). In affected versions specific DATA submessages can be sent to a discovery locator which may trigger a free error. This can remotely crash any Fast-DDS process. The call to free() could potentially leave the pointer in the attackers control which could lead to a double free. This issue has been addressed in versions 2.12.0, 2.11.3, 2.10.3, and 2.6.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

21 Nov 2024, 08:22

Type Values Removed Values Added
References () https://github.com/eProsima/Fast-DDS/issues/3207 - Exploit, Issue Tracking () https://github.com/eProsima/Fast-DDS/issues/3207 - Exploit, Issue Tracking
References () https://github.com/eProsima/Fast-DDS/pull/3824 - Patch () https://github.com/eProsima/Fast-DDS/pull/3824 - Patch
References () https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-gq8g-fj58-22gm - Vendor Advisory () https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-gq8g-fj58-22gm - Vendor Advisory
References () https://www.debian.org/security/2023/dsa-5568 - () https://www.debian.org/security/2023/dsa-5568 -
CVSS v2 : unknown
v3 : 7.5 		v2 : unknown
v3 : 8.6

28 Nov 2023, 01:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-10-16 21:15

Updated : 2025-02-13 17:17

NVD link : CVE-2023-42459

Mitre link : CVE-2023-42459

CVE.ORG link : CVE-2023-42459

JSON object : View

Products Affected

eprosima

  • fast_dds
CWE
CWE-415

Double Free

CWE-416

Use After Free

CWE-590

Free of Memory not on the Heap