CVE-2021-38445
📋 TL;DR
This vulnerability in OpenDDS allows remote attackers to execute arbitrary code by sending specially crafted data packets that exploit inconsistent length parameter handling. It affects all systems running OpenDDS versions before 3.18.1, particularly in industrial control and embedded systems where OpenDDS is commonly used for data distribution.
💻 Affected Systems
- OpenDDS
📦 What is this software?
Opendds by Objectcomputing
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with remote code execution leading to data theft, system manipulation, or disruption of critical operations.
Likely Case
Remote code execution allowing attackers to gain control of affected systems, potentially leading to data exfiltration or service disruption.
If Mitigated
Limited impact if proper network segmentation and access controls prevent unauthorized access to OpenDDS services.
🎯 Exploit Status
Exploitation requires crafting specific malformed packets but does not require authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.18.1
Vendor Advisory: https://opendds.org/
Restart Required: Yes
Instructions:
1. Download OpenDDS version 3.18.1 or later from opendds.org. 2. Replace existing OpenDDS installation with patched version. 3. Recompile any applications using OpenDDS. 4. Restart all OpenDDS services and dependent applications.
🔧 Temporary Workarounds
Network Segmentation
allIsolate OpenDDS services from untrusted networks
Firewall Rules
allRestrict access to OpenDDS ports (typically 7400-7410)
iptables -A INPUT -p tcp --dport 7400:7410 -j DROP
netsh advfirewall firewall add rule name="Block OpenDDS" dir=in action=block protocol=TCP localport=7400-7410
🧯 If You Can't Patch
- Implement strict network access controls to limit which systems can communicate with OpenDDS services
- Deploy intrusion detection systems to monitor for exploitation attempts and anomalous network traffic
🔍 How to Verify
Check if Vulnerable:
Check OpenDDS version: grep -i version /path/to/opendds/config/files or check application documentationCheck Version:
opendds_info --version or check OpenDDS library version in applicationVerify Fix Applied:
Confirm OpenDDS version is 3.18.1 or later and verify services are running with updated binaries📡 Detection & Monitoring
Log Indicators:
- Unusual process creation from OpenDDS services
- Memory access violations in OpenDDS logs
- Abnormal termination of OpenDDS processes
Network Indicators:
- Unusual traffic patterns to OpenDDS ports (7400-7410)
- Malformed packets targeting OpenDDS services
- Unexpected connections to/from OpenDDS systems
SIEM Query:
source="opendds.log" AND (event_type="crash" OR event_type="memory_violation") OR dest_port IN (7400, 7401, 7402, 7403, 7404, 7405, 7406, 7407, 7408, 7409, 7410) AND packet_size > threshold