Skip to content
OpenAdvisories
High USN-6306-1 7 CVEs

fastdds vulnerabilities

Published Aug 24, 2023 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Fast DDS incorrectly handled certain inputs.
A remote attacker could possibly use this issue to cause a denial of
service and information exposure. This issue only affected Ubuntu
22.04 LTS. (CVE-2021-38425)

It was discovered that Fast DDS incorrectly handled certain inputs.
An attacker could possibly use this issue to cause a crash.
(CVE-2023-39534, CVE-2023-39945, CVE-2023-39946, CVE-2023-39947,
CVE-2023-39948, CVE-2023-39949)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS fastdds 2.5.0+ds-3ubuntu0.1~esm1

Vulnerabilities 7

  • High 8.2
    CVE-2023-39945

    Malformed serialized data in a data submessage leads to unhandled exception

    eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.11.0, 2.10.2, 2.9.2, and 2.6.5, a data submessage sent to PDP port raises unhandled `BadParamException` in fastcdr, which i…

    eProsima Fast-DDS fastdds fastdds Debian Ubuntu
  • High 8.2
    CVE-2023-39946

    Heap overflow in push_back_helper due to a CDR message

    eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.11.1, 2.10.2, 2.9.2, and 2.6.6, heap can be overflowed by providing a PID_PROPERTY_LIST parameter that contains a CDR strin…

    eProsima Fast-DDS fastdds fastdds Debian Ubuntu
  • High 8.2
    CVE-2023-39947

    Another heap overflow in push_back_helper

    eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.11.1, 2.10.2, 2.9.2, and 2.6.6, even after the fix at commit 3492270, malformed `PID_PROPERTY_LIST` parameters cause heap o…

    eProsima Fast-DDS fastdds fastdds Debian Ubuntu
  • High 7.5
    CVE-2021-38425

    eProsima Fast DDS Network Amplification

    eProsima Fast DDS versions prior to 2.4.0 (#2269) are susceptible to exploitation when an attacker sends a specially crafted packet to flood a target device with unwanted traffic, which may result in a denial-of-service condition and information exposure.

    eProsima Fast-DDS fastdds fastdds Debian Ubuntu
  • High 7.5
    CVE-2023-39534

    Malformed GAP submessage triggers assertion failure

    eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.10.0, 2.9.2, and 2.6.5, a malformed GAP submessage can trigger assertion failure, crashing FastDDS. Version 2.10.0, 2.9.2, …

    eProsima Fast-DDS fastdds fastdds Debian Ubuntu
  • High 7.5
    CVE-2023-39948

    Uncaught fastcdr exception (Unexpected CDR type received) crashing fastdds

    eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.10.0 and 2.6.5, the `BadParamException` thrown by Fast CDR is not caught in Fast DDS. This can remotely crash any Fast DDS …

    eProsima Fast-DDS fastdds fastdds Debian Ubuntu
  • High 7.5
    CVE-2023-39949

    Improper validation of sequence numbers leading to remotely reachable assertion failure

    eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.9.1 and 2.6.5, improper validation of sequence numbers may lead to remotely reachable assertion failure. This can remotely …

    eProsima Fast-DDS fastdds fastdds Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2021-38425
  • report
    https://ubuntu.com/security/CVE-2023-39534
  • report
    https://ubuntu.com/security/CVE-2023-39945
  • report
    https://ubuntu.com/security/CVE-2023-39946
  • report
    https://ubuntu.com/security/CVE-2023-39947
  • report
    https://ubuntu.com/security/CVE-2023-39948
  • report
    https://ubuntu.com/security/CVE-2023-39949