CVE-2023-39946 Heap overflow in push_back_helper due to a CDR message
A heap overflow in eProsima Fast DDS allows remote attackers to crash processes via malicious CDR messages on the discovery multicast port.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-39946?
CVE-2023-39946 is a high-severity memory corruption vulnerability in Debian Debian Linux, published on 11 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.11.1, 2.10.2, 2.9.2, and 2.6.6, heap can be overflowed by providing a PID_PROPERTY_LIST parameter that contains a CDR string with length larger than the size of actual content. In `eprosima::fastdds::dds::ParameterPropertyList_t::push_back_helper`, `memcpy` is called to first copy the octet'ized length and then to copy the data into `properties_.data`. At the second memcpy, both `data` and `size` can be controlled by anyone that sends the CDR string to the discovery multicast port. This can remotely crash any Fast-DDS process. Versions 2.11.1, 2.10.2, 2.9.2, and 2.6.6 contain a patch for this issue.
Which versions are affected by CVE-2023-39946?
It affects 2 products.
Products include Debian Debian Linux, Eprosima Fast Dds.
How do I fix CVE-2023-39946?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2023-39946 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-39946 exists.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2023-39946, GHSA-j297-rg6j-m7hx, UBUNTU-CVE-2023-39946.