CVE-2023-39946 - CVE House

Back to Database

Status published High CVE-2023-39946

Heap overflow in push_back_helper due to a CDR message

8.2 CVSS

Vulnerability Description

eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.11.1, 2.10.2, 2.9.2, and 2.6.6, heap can be overflowed by providing a PID_PROPERTY_LIST parameter that contains a CDR string with length larger than the size of actual content. In `eprosima::fastdds::dds::ParameterPropertyList_t::push_back_helper`, `memcpy` is called to first copy the octet'ized length and then to copy the data into `properties_.data`. At the second memcpy, both `data` and `size` can be controlled by anyone that sends the CDR string to the discovery multicast port. This can remotely crash any Fast-DDS process. Versions 2.11.1, 2.10.2, 2.9.2, and 2.6.6 contain a patch for this issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-39946

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from eProsima

View All →

Fast-DDS: Unbounded GAP range triggers OOM DoS under RELIABLE QoS

FastDDS has Out-of-memory in readOctetVector via Manipulated DATA Submessage when DDS Security is enabled

FastDDS's heap buffer overflow in RTPS DATA_FRAG enables unauthenticated DoS (potential RCE)

FastDDS has Out-of-memory while parsing GenericMessage when DDS Security is enabled

FastDDS has heap buffer overflow in readData via Manipulated DATA Submessage when DDS Security is enabled

Affected Vendor

eProsima

View all reports →

Affected Software

Fast-DDS

Vulnerable Versions:

< 2.6.6, >= 2.7.0, < 2.9.2, >= 2.10.0, < 2.10.2, = 2.11.0

Timeline

Official Publish: August 11th, 2023

Last Modified: February 13th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1203 Exploitation for Client Execution

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1055 Process Injection

Defense Evasion