CVE-2023-39946
📋 TL;DR
CVE-2023-39946 is a heap overflow vulnerability in eprosima Fast DDS that allows remote attackers to crash any Fast-DDS process by sending a specially crafted CDR string to the discovery multicast port. This affects all systems running vulnerable versions of Fast DDS with discovery enabled. The vulnerability can be exploited without authentication.
💻 Affected Systems
- eprosima Fast DDS
📦 What is this software?
Fast Dds by Eprosima
Fast Dds by Eprosima
Fast Dds by Eprosima
Fast Dds by Eprosima
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, though this requires additional exploitation beyond the demonstrated crash.
Likely Case
Remote denial of service causing Fast-DDS processes to crash, disrupting data distribution services.
If Mitigated
No impact if patched versions are used or if discovery multicast port is properly firewalled.
🎯 Exploit Status
The advisory provides technical details that make exploitation straightforward. No authentication required to send discovery packets.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.11.1, 2.10.2, 2.9.2, or 2.6.6
Vendor Advisory: https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-j297-rg6j-m7hx
Restart Required: Yes
Instructions:
1. Identify current Fast DDS version. 2. Upgrade to patched version (2.11.1, 2.10.2, 2.9.2, or 2.6.6). 3. Recompile applications using Fast DDS. 4. Restart all Fast DDS processes.
🔧 Temporary Workarounds
Block Discovery Multicast Ports
linuxBlock UDP traffic to discovery multicast ports (typically 7400-7410) at network perimeter or host firewall.
sudo iptables -A INPUT -p udp --dport 7400:7410 -j DROP
sudo iptables -A OUTPUT -p udp --dport 7400:7410 -j DROP
Disable Discovery
allConfigure Fast DDS to use static discovery instead of dynamic discovery.
Set DomainParticipantQos to use static discovery in XML configuration
🧯 If You Can't Patch
- Implement network segmentation to isolate Fast DDS systems from untrusted networks.
- Deploy intrusion detection systems to monitor for exploitation attempts on discovery ports.
🔍 How to Verify
Check if Vulnerable:
Check Fast DDS version and compare against vulnerable versions. If using discovery and version < 2.11.1, 2.10.2, 2.9.2, or 2.6.6, system is vulnerable.Check Version:
Check application documentation or build configuration for Fast DDS version. For compiled applications, use strings command: strings binary_name | grep FastVerify Fix Applied:
Verify Fast DDS version is 2.11.1, 2.10.2, 2.9.2, or 2.6.6 or higher. Test discovery functionality works without crashes.📡 Detection & Monitoring
Log Indicators:
- Segmentation fault or crash logs from Fast DDS processes
- Unexpected termination of Fast DDS services
Network Indicators:
- Unusual UDP traffic to port 7400-7410 with large payloads
- Multiple discovery packets from single source
SIEM Query:
source_port=7400-7410 AND protocol=udp AND payload_size>normal_threshold🔗 References
- https://github.com/eProsima/Fast-DDS/commit/349227005827e8a67a0406b823138b5068cc47dc
- https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-j297-rg6j-m7hx
- https://www.debian.org/security/2023/dsa-5481
- https://github.com/eProsima/Fast-DDS/commit/349227005827e8a67a0406b823138b5068cc47dc
- https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-j297-rg6j-m7hx
- https://www.debian.org/security/2023/dsa-5481
