CVE-2023-37915 Malformed PID_PROPERTY_LIST parameter in DATA submessage remotely crashes OpenDDS

High 7.5 Published 21 Jul 2023 Updated 10 Oct 2024

Remote attackers can crash OpenDDS processes by sending malformed data during discovery, requiring an upgrade to mitigate.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-37915?

CVE-2023-37915 is a high-severity denial of service vulnerability in OpenDDS, published on 21 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

OpenDDS is an open source C++ implementation of the Object Management Group (OMG) Data Distribution Service (DDS). OpenDDS crashes while parsing a malformed `PID_PROPERTY_LIST` in a DATA submessage during participant discovery. Attackers can remotely crash OpenDDS processes by sending a DATA submessage containing the malformed parameter to the known multicast port. This issue has been addressed in version 3.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Weakness: CWE-20

Which versions are affected by CVE-2023-37915?

It affects 1 product.

Products include Objectcomputing Opendds.

How do I fix CVE-2023-37915?

No fix has been published for CVE-2023-37915 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-37915 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-37915 exists.

Sources

Also known as GHSA-v5pp-7prc-5xq9.