CVE-2023-39534 - Vulnerability Details - OpenCVE

ReportizFlow

eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.10.0, 2.9.2, and 2.6.5, a malformed GAP submessage can trigger assertion failure, crashing FastDDS. Version 2.10.0, 2.9.2, and 2.6.5 contain a patch for this issue.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable yes

Technical Impact partial

Vendors	Products
Debian	Debian Linux
Eprosima	Fast Dds

Configuration 1 [-]

OR	cpe:2.3:a:eprosima:fast_dds::::::::
	cpe:2.3:a:eprosima:fast_dds::::::::
	cpe:2.3:a:eprosima:fast_dds:2.10.0:rc1::::::

Configuration 2 [-]

OR	cpe:2.3:o:debian:debian_linux:11.0:::::::*
	cpe:2.3:o:debian:debian_linux:12.0:::::::*

No data.

References

Link	Providers
https://bombshell.gtisc.gatech.edu/ddsfuzz/pcap/fastdds-assert-230509.pcap
https://github.com/eProsima/Fast-DDS/blob/v2.9.1/include/fastdds/rtps/common/SequenceNumber.h#L238-L252
https://github.com/eProsima/Fast-DDS/blob/v2.9.1/src/cpp/rtps/reader/StatefulReader.cpp#L863
https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-fcr6-x23w-94wp
https://www.debian.org/security/2023/dsa-5481

History

Wed, 09 Oct 2024 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2023-08-11T13:12:00.633Z

Updated: 2024-10-09T18:56:49.838Z

Reserved: 2023-08-03T16:27:36.264Z

Link: CVE-2023-39534

Vulnrichment

Updated: 2024-08-02T18:10:21.131Z

NVD

Status : Modified

Published: 2023-08-11T14:15:13.240

Modified: 2024-11-21T08:15:37.390

Link: CVE-2023-39534

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-39534", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-08-03T16:27:36.264Z", "datePublished": "2023-08-11T13:12:00.633Z", "dateUpdated": "2024-10-09T18:56:49.838Z"}, "containers": {"cna": {"title": "Malformed GAP submessage triggers assertion failure", "problemTypes": [{"descriptions": [{"cweId": "CWE-617", "lang": "en", "description": "CWE-617: Reachable Assertion", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-fcr6-x23w-94wp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-fcr6-x23w-94wp"}, {"name": "https://bombshell.gtisc.gatech.edu/ddsfuzz/pcap/fastdds-assert-230509.pcap", "tags": ["x_refsource_MISC"], "url": "https://bombshell.gtisc.gatech.edu/ddsfuzz/pcap/fastdds-assert-230509.pcap"}, {"name": "https://github.com/eProsima/Fast-DDS/blob/v2.9.1/include/fastdds/rtps/common/SequenceNumber.h#L238-L252", "tags": ["x_refsource_MISC"], "url": "https://github.com/eProsima/Fast-DDS/blob/v2.9.1/include/fastdds/rtps/common/SequenceNumber.h#L238-L252"}, {"name": "https://github.com/eProsima/Fast-DDS/blob/v2.9.1/src/cpp/rtps/reader/StatefulReader.cpp#L863", "tags": ["x_refsource_MISC"], "url": "https://github.com/eProsima/Fast-DDS/blob/v2.9.1/src/cpp/rtps/reader/StatefulReader.cpp#L863"}, {"url": "https://www.debian.org/security/2023/dsa-5481"}], "affected": [{"vendor": "eProsima", "product": "Fast-DDS", "versions": [{"version": "< 2.6.5", "status": "affected"}, {"version": ">= 2.7.0, < 2.9.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-08-11T13:21:09.501Z"}, "descriptions": [{"lang": "en", "value": "eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.10.0, 2.9.2, and 2.6.5, a malformed GAP submessage can trigger assertion failure, crashing FastDDS. Version 2.10.0, 2.9.2, and 2.6.5 contain a patch for this issue."}], "source": {"advisory": "GHSA-fcr6-x23w-94wp", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T18:10:21.131Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-fcr6-x23w-94wp", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-fcr6-x23w-94wp"}, {"name": "https://bombshell.gtisc.gatech.edu/ddsfuzz/pcap/fastdds-assert-230509.pcap", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://bombshell.gtisc.gatech.edu/ddsfuzz/pcap/fastdds-assert-230509.pcap"}, {"name": "https://github.com/eProsima/Fast-DDS/blob/v2.9.1/include/fastdds/rtps/common/SequenceNumber.h#L238-L252", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/eProsima/Fast-DDS/blob/v2.9.1/include/fastdds/rtps/common/SequenceNumber.h#L238-L252"}, {"name": "https://github.com/eProsima/Fast-DDS/blob/v2.9.1/src/cpp/rtps/reader/StatefulReader.cpp#L863", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/eProsima/Fast-DDS/blob/v2.9.1/src/cpp/rtps/reader/StatefulReader.cpp#L863"}, {"url": "https://www.debian.org/security/2023/dsa-5481", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-09T18:56:42.571569Z", "id": "CVE-2023-39534", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-09T18:56:49.838Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-fcr6-x23w-94wp", "name": "https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-fcr6-x23w-94wp", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://bombshell.gtisc.gatech.edu/ddsfuzz/pcap/fastdds-assert-230509.pcap", "name": "https://bombshell.gtisc.gatech.edu/ddsfuzz/pcap/fastdds-assert-230509.pcap", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/eProsima/Fast-DDS/blob/v2.9.1/include/fastdds/rtps/common/SequenceNumber.h#L238-L252", "name": "https://github.com/eProsima/Fast-DDS/blob/v2.9.1/include/fastdds/rtps/common/SequenceNumber.h#L238-L252", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/eProsima/Fast-DDS/blob/v2.9.1/src/cpp/rtps/reader/StatefulReader.cpp#L863", "name": "https://github.com/eProsima/Fast-DDS/blob/v2.9.1/src/cpp/rtps/reader/StatefulReader.cpp#L863", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://www.debian.org/security/2023/dsa-5481", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T18:10:21.131Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-39534", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-09T18:56:42.571569Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-09T18:56:46.379Z"}}], "cna": {"title": "Malformed GAP submessage triggers assertion failure", "source": {"advisory": "GHSA-fcr6-x23w-94wp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "eProsima", "product": "Fast-DDS", "versions": [{"status": "affected", "version": "< 2.6.5"}, {"status": "affected", "version": ">= 2.7.0, < 2.9.2"}]}], "references": [{"url": "https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-fcr6-x23w-94wp", "name": "https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-fcr6-x23w-94wp", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://bombshell.gtisc.gatech.edu/ddsfuzz/pcap/fastdds-assert-230509.pcap", "name": "https://bombshell.gtisc.gatech.edu/ddsfuzz/pcap/fastdds-assert-230509.pcap", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/eProsima/Fast-DDS/blob/v2.9.1/include/fastdds/rtps/common/SequenceNumber.h#L238-L252", "name": "https://github.com/eProsima/Fast-DDS/blob/v2.9.1/include/fastdds/rtps/common/SequenceNumber.h#L238-L252", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/eProsima/Fast-DDS/blob/v2.9.1/src/cpp/rtps/reader/StatefulReader.cpp#L863", "name": "https://github.com/eProsima/Fast-DDS/blob/v2.9.1/src/cpp/rtps/reader/StatefulReader.cpp#L863", "tags": ["x_refsource_MISC"]}, {"url": "https://www.debian.org/security/2023/dsa-5481"}], "descriptions": [{"lang": "en", "value": "eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.10.0, 2.9.2, and 2.6.5, a malformed GAP submessage can trigger assertion failure, crashing FastDDS. Version 2.10.0, 2.9.2, and 2.6.5 contain a patch for this issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-617", "description": "CWE-617: Reachable Assertion"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-08-11T13:21:09.501Z"}}}, "cveMetadata": {"cveId": "CVE-2023-39534", "state": "PUBLISHED", "dateUpdated": "2024-10-09T18:56:49.838Z", "dateReserved": "2023-08-03T16:27:36.264Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2023-08-11T13:12:00.633Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:eprosima:fast_dds:*:*:*:*:*:*:*:*", "matchCriteriaId": "A5F6650B-AD38-4E23-94EC-691A17D787EB", "versionEndExcluding": "2.6.5", "versionStartIncluding": "2.6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:eprosima:fast_dds:*:*:*:*:*:*:*:*", "matchCriteriaId": "ACDC404A-DC49-462D-A906-D5B726B5511A", "versionEndExcluding": "2.9.2", "versionStartIncluding": "2.9.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:eprosima:fast_dds:2.10.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "B9255BCA-332A-4107-9A21-95907F1B6F2C", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}, {"criteria": "cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*", "matchCriteriaId": "46D69DCC-AE4D-4EA5-861C-D60951444C6C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.10.0, 2.9.2, and 2.6.5, a malformed GAP submessage can trigger assertion failure, crashing FastDDS. Version 2.10.0, 2.9.2, and 2.6.5 contain a patch for this issue."}, {"lang": "es", "value": "eprosima Fast DDS es una implementaci\u00f3n en C++ del est\u00e1ndar Data Distribution Service del Object Management Group. Antes de las versiones 2.10.0, 2.9.2 y 2.6.5, un submensaje GAP malformado pod\u00eda provocar un fallo de aserci\u00f3n, bloqueando FastDDS. Las versiones 2.10.0, 2.9.2 y 2.6.5 contienen un parche para este problema.\n"}], "id": "CVE-2023-39534", "lastModified": "2024-11-21T08:15:37.390", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "[email protected]", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "[email protected]", "type": "Primary"}]}, "published": "2023-08-11T14:15:13.240", "references": [{"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "https://bombshell.gtisc.gatech.edu/ddsfuzz/pcap/fastdds-assert-230509.pcap"}, {"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "https://github.com/eProsima/Fast-DDS/blob/v2.9.1/include/fastdds/rtps/common/SequenceNumber.h#L238-L252"}, {"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "https://github.com/eProsima/Fast-DDS/blob/v2.9.1/src/cpp/rtps/reader/StatefulReader.cpp#L863"}, {"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-fcr6-x23w-94wp"}, {"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "https://www.debian.org/security/2023/dsa-5481"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://bombshell.gtisc.gatech.edu/ddsfuzz/pcap/fastdds-assert-230509.pcap"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/eProsima/Fast-DDS/blob/v2.9.1/include/fastdds/rtps/common/SequenceNumber.h#L238-L252"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/eProsima/Fast-DDS/blob/v2.9.1/src/cpp/rtps/reader/StatefulReader.cpp#L863"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-fcr6-x23w-94wp"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.debian.org/security/2023/dsa-5481"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-617"}], "source": "[email protected]", "type": "Secondary"}]}