CVE-2024-28231 Manipulated DATA Submessage causes a heap-buffer-overflow error
A manipulated DATA Submessage triggers an integer overflow leading to heap-buffer-overflow, causing remote denial of service in eProsima Fast DDS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-28231?
CVE-2024-28231 is a critical vulnerability in eProsima Fast-DDS, published on 20 Mar 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.14.0, 2.13.4, 2.12.3, 2.10.4, and 2.6.8, manipulated DATA Submessage can cause a heap overflow error in the Fast-DDS process, causing the process to be terminated remotely. Additionally, the payload_size in the DATA Submessage packet is declared as uint32_t. When a negative number, such as -1, is input into this variable, it results in an Integer Overflow (for example, -1 gets converted to 0xFFFFFFFF). This eventually leads to a heap-buffer-overflow, causing the program to terminate. Versions 2.14.0, 2.13.4, 2.12.3, 2.10.4, and 2.6.8 contain a fix for this issue.
Which versions are affected by CVE-2024-28231?
It affects 1 product.
Products include Eprosima Fast Dds.
How do I fix CVE-2024-28231?
Upgrade to a fixed version.
Is CVE-2024-28231 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-28231 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in eProsima Fast-DDS
- CVE-2025-67108 Security feature bypass in n/a
- CVE-2023-50716 Invalid DATA_FRAG Submessage causes a bad-free error
- CVE-2023-50257 Disconnect Vulnerability in RTPS Packets Used by SROS2
- CVE-2023-42459 Malformed DATA submessage leads to bad-free error in Fast-DDS
- CVE-2024-30258 FastDDS crash when publisher send malformed packet
Sources
Also known as DEBIAN-CVE-2024-28231, GHSA-9m2j-qw67-ph4w, UBUNTU-CVE-2024-28231.