Skip to content
OpenAdvisories
Critical · 9.7 Public exploit CVE-2023-50257 EUVD-2023-55071

Disconnect Vulnerability in RTPS Packets Used by SROS2

Published Feb 19, 2024 · Updated Aug 14, 2024 · Assigned by GitHub_M

Description

eProsima Fast DDS (formerly Fast RTPS) is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Even with the application of SROS2, due to the issue where the data (`p[UD]`) and `guid` values used to disconnect between nodes are not encrypted, a vulnerability has been discovered where a malicious attacker can forcibly disconnect a Subscriber and can deny a Subscriber attempting to connect. Afterwards, if the attacker sends the packet for disconnecting, which is data (`p[UD]`), to the Global Data Space (`239.255.0.1:7400`) using the said Publisher ID, all the Subscribers (Listeners) connected to the Publisher (Talker) will not receive any data and their connection will be disconnected. Moreover, if this disconnection packet is sent continuously, the Subscribers (Listeners) trying to connect will not be able to do so. Since the initial commit of the `SecurityManager.cpp` code (`init`, `on_process_handshake`) on Nov 8, 2016, the Disconnect Vulnerability in RTPS Packets Used by SROS2 has been present prior to versions 2.13.0, 2.12.2, 2.11.3, 2.10.3, and 2.6.7.

Affected products

VendorProductAffectedFixed
eProsima Fast-DDS >= 2.12.0, < 2.12.2, >= 2.11.0, < 2.11.3, >= 2.7.0, < 2.10.3, < 2.6.7, FastDDS = 2.10.2-2, RMW - FastDDS = 7.1.1-2, FastDDS = 2.6.6-1, RMW - FastDDS = 6.2.3.1, FastDDS = 2.3.6-6, RMW - FastDDS = 5.0.2-1, FastDDS = 2.1.4-1, RMW - FastDDS = 1.3.2-1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 13 fastdds 2.14.0+ds-2 —
Debian 12 fastdds No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS fastdds No fix yet —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS fastdds No fix yet —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • Jminis/CVE-2023-50257 ★ 0 · Apr 20, 2025

    This repository is for research purposes (2025 Sejong Univ. Capstone Design)

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References