Skip to content
OpenAdvisories
Critical · 9.7 Public exploit CVE-2024-28231 EUVD-2024-25347

Manipulated DATA Submessage causes a heap-buffer-overflow error

Published Mar 20, 2024 · Updated Aug 2, 2024 · Assigned by GitHub_M

Description

eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.14.0, 2.13.4, 2.12.3, 2.10.4, and 2.6.8, manipulated DATA Submessage can cause a heap overflow error in the Fast-DDS process, causing the process to be terminated remotely. Additionally, the payload_size in the DATA Submessage packet is declared as uint32_t. When a negative number, such as -1, is input into this variable, it results in an Integer Overflow (for example, -1 gets converted to 0xFFFFFFFF). This eventually leads to a heap-buffer-overflow, causing the program to terminate. Versions 2.14.0, 2.13.4, 2.12.3, 2.10.4, and 2.6.8 contain a fix for this issue.

Affected products

VendorProductAffectedFixed
eProsima Fast-DDS < 2.6.8, >= 2.7.0, < 2.10.4, >= 2.11.0, < 2.12.2, >= 2.13.0, < 2.13.4 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 13 fastdds 2.14.0+ds-2 —
Debian 12 fastdds No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 fastdds No fix yet —
Ubuntu 26.04 LTS fastdds No fix yet —
Ubuntu 25.10 fastdds No fix yet —
Ubuntu 24.04 LTS fastdds No fix yet —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS fastdds No fix yet —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References