CVE-2023-37915
📋 TL;DR
This vulnerability allows remote attackers to crash OpenDDS processes by sending a specially crafted DATA submessage during participant discovery. It affects all OpenDDS users running vulnerable versions, particularly those using multicast discovery. The crash occurs while parsing a malformed PID_PROPERTY_LIST parameter.
💻 Affected Systems
- OpenDDS
📦 What is this software?
Opendds by Objectcomputing
⚠️ Risk & Real-World Impact
Worst Case
Denial of service causing complete service disruption for OpenDDS-based applications, potentially affecting critical systems that rely on real-time data distribution.
Likely Case
Service disruption and application crashes in OpenDDS deployments, leading to data distribution failures and system instability.
If Mitigated
No impact if patched version is deployed or if network controls prevent malicious traffic from reaching OpenDDS instances.
🎯 Exploit Status
Exploitation requires sending malformed DATA submessages to the known multicast port used by OpenDDS for discovery.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.25
Vendor Advisory: https://github.com/OpenDDS/OpenDDS/security/advisories/GHSA-v5pp-7prc-5xq9
Restart Required: Yes
Instructions:
1. Download OpenDDS version 3.25 from GitHub releases. 2. Replace existing OpenDDS installation with version 3.25. 3. Recompile and redeploy applications using OpenDDS. 4. Restart all OpenDDS processes.
🔧 Temporary Workarounds
No known workarounds
allThe vendor advisory states there are no known workarounds for this vulnerability.
🧯 If You Can't Patch
- Implement network segmentation to restrict access to OpenDDS multicast ports (typically 7400-7401)
- Deploy network monitoring and intrusion detection to detect malformed DATA submessages
🔍 How to Verify
Check if Vulnerable:
Check OpenDDS version: If version is earlier than 3.25, system is vulnerable.Check Version:
Check OpenDDS documentation or build configuration for version information. For compiled applications, check linked libraries or consult application documentation.Verify Fix Applied:
Verify OpenDDS version is 3.25 or later and test application functionality with discovery traffic.📡 Detection & Monitoring
Log Indicators:
- OpenDDS process crashes
- Discovery protocol errors
- Abnormal termination of OpenDDS services
Network Indicators:
- Malformed DATA submessages to multicast ports 7400-7401
- Unusual traffic patterns to OpenDDS discovery ports
SIEM Query:
source_port:7400 OR source_port:7401 AND (protocol:UDP) AND (payload_contains:"PID_PROPERTY_LIST")