Vulnerability Intelligence Report
Invalid DATA_FRAG Submessage causes a bad-free error
CVE-2023-50716
eProsima Fast DDS (formerly Fast RTPS) is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.13.0, 2.12.2, 2.11.3, 2.10.3, and 2.6.7, an invalid DATA_FRAG Submessage causes a bad-free error, and the Fast-DDS process can be remotely terminated. If an invalid Data_Frag packet is sent, the `Inline_qos, SerializedPayload` member of object `ch` will attempt to release memory without initialization, resulting in a 'bad-free' error. Versions 2.13.0, 2.12.2, 2.11.3, 2.10.2, and 2.6.7 fix this issue.
No Active Exploit Signals
CVSS Base Score
9.7
CRITICAL
Exploitability:2.9
Impact Score:6.1
EPSS Probability:0.72%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-416 ↗CWE-416: Use After Free
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| eProsima | Fast-DDS | >= 2.12.0, < 2.12.2 (affected), >= 2.11.0, < 2.11.3 (affected), >= 2.10.0, < 2.10.3 (affected), < 2.6.7 (affected) |
Threat Intelligence Signals
EPSS Score
0.724%
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | GitHub, Inc. · Vendor · USA |
| Reserved | 2023-12-11T17:53:36 |
| Published | 2024-03-06T17:23:55 |
| Last Updated | 2024-08-02T22:16:47 |
Community Chatter & Buzz