CVE-2023-50257 Disconnect Vulnerability in RTPS Packets Used by SROS2
Attackers can forcibly disconnect subscribers and prevent new connections in SROS2-enabled Fast DDS applications by sending unencrypted RTPS packets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-50257?
CVE-2023-50257 is a critical denial of service vulnerability in eProsima Fast-DDS, published on 19 Feb 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
eProsima Fast DDS (formerly Fast RTPS) is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Even with the application of SROS2, due to the issue where the data (`p[UD]`) and `guid` values used to disconnect between nodes are not encrypted, a vulnerability has been discovered where a malicious attacker can forcibly disconnect a Subscriber and can deny a Subscriber attempting to connect. Afterwards, if the attacker sends the packet for disconnecting, which is data (`p[UD]`), to the Global Data Space (`239.255.0.1:7400`) using the said Publisher ID, all the Subscribers (Listeners) connected to the Publisher (Talker) will not receive any data and their connection will be disconnected. Moreover, if this disconnection packet is sent continuously, the Subscribers (Listeners) trying to connect will not be able to do so. Since the initial commit of the `SecurityManager.cpp` code (`init`, `on_process_handshake`) on Nov 8, 2016, the Disconnect Vulnerability in RTPS Packets Used by SROS2 has been present prior to versions 2.13.0, 2.12.2, 2.11.3, 2.10.3, and 2.6.7.
Weakness: CWE-284
Which versions are affected by CVE-2023-50257?
It affects 1 product.
Products include Eprosima Fast Dds.
How do I fix CVE-2023-50257?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-50257 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-50257 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in eProsima Fast-DDS
- CVE-2025-67108 Security feature bypass in n/a
- CVE-2024-28231 Manipulated DATA Submessage causes a heap-buffer-overflow error
- CVE-2023-50716 Invalid DATA_FRAG Submessage causes a bad-free error
- CVE-2023-42459 Malformed DATA submessage leads to bad-free error in Fast-DDS
- CVE-2024-30258 FastDDS crash when publisher send malformed packet
Sources
Also known as DEBIAN-CVE-2023-50257, GHSA-v5r6-8mvh-cp98, UBUNTU-CVE-2023-50257.