CVE-2024-30258

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-30258
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-30258.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-30258
Aliases
  • GHSA-53xw-465j-rxfh
Downstream
Published
2024-05-13T14:41:52.318Z
Modified
2026-08-12T15:15:55.962041Z
Severity
  • 8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H CVSS Calculator
Summary
FastDDS crash when publisher send malformed packet
Details

FastDDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to versions 2.14.1, 2.13.5, 2.10.4, and 2.6.8, when a publisher serves a malformed RTPS packet, the subscriber crashes when creating pthread. This can remotely crash any Fast-DDS process, potentially leading to a DOS attack. Versions 2.14.1, 2.13.5, 2.10.4, and 2.6.8 contain a patch for the issue.

Database specific 
{
    "cwe_ids": [
        "CWE-20"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/30xxx/CVE-2024-30258.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/eprosima/fast-dds

Affected ranges

Type
GIT
Repo
https://github.com/eprosima/fast-dds
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
77cfbe8a3a831ac525dbaf4c741743f65f3316c1
Introduced
463d59ca81c7fd732edf45b982a58c0b54fc1da4
Fixed
3118cba80c7b0db2c9bd0ede8671e3d31785cbda
Introduced
f633573e69e0552f5f0a48d5ed960a0782e2fea8
Fixed
f376f7eb3758ec523fed0519e84e768233668b25
Introduced
4c2016660e7d6a6e94970e1a2b4dcd8e47f21581
Fixed
65236f93e9c4ea3ff9a49fba4dfd9e43eb94037b
Database specific
Show details 
{
    "cpe": [
        "cpe:2.3:a:eprosima:fast_dds:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:eprosima:fast_dds:2.14.0:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.6.8"
        },
        {
            "introduced": "2.10.0"
        },
        {
            "fixed": "2.10.4"
        },
        {
            "introduced": "2.13.0"
        },
        {
            "fixed": "2.13.5"
        },
        {
            "introduced": "2.14.0"
        },
        {
            "last_affected": "2.14.0"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

2.*
2.0.0-beta
2.0.0-rc
2.14.0
= 2.*
= 2.14.0
Other
Discovery-Time_Data_Typing
v1.*
v1.0.0
v1.3.0
v1.4.0
v1.5.0
v1.6.0
v1.7.0
v1.7.1
v1.7.2
v1.8.0
v1.8.0-2
v1.9.0
v1.9.0-beta
v1.9.0-beta-2
v2.*
v2.1.0
v2.10.0-rc1
v2.10.1-rc1
v2.10.4
v2.2.0
v2.3.0-1
v2.3.0-api

Database specific

vanir_signatures_modified 
"2026-08-12T15:15:55Z"
vanir_signatures 
[
    {
        "id": "CVE-2024-30258-01d6604f",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 365.0,
            "function_hash": "242182022801325256429813967358559793687"
        },
        "source": "https://github.com/eprosima/fast-dds/commit/65236f93e9c4ea3ff9a49fba4dfd9e43eb94037b",
        "target": {
            "function": "CDRMessage::readPropertySeq",
            "file": "include/fastdds/rtps/messages/CDRMessage.hpp"
        }
    },
    {
        "id": "CVE-2024-30258-0e131023",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "138431363960578698831157643269849350209",
                "202953979137769814025072037667196394416",
                "64522563809543713068746728859623721108",
                "226713098724485749457536436707249755375",
                "239711052607765599261008427573505231147",
                "336887187227635751907172444112008797293",
                "102880577847477033559200857612742969727",
                "259237941899490372267197073528540958210",
                "80749173776496764784838024979006120949",
                "59212284618819110786796013841479526212"
            ]
        },
        "source": "https://github.com/eprosima/fast-dds/commit/65236f93e9c4ea3ff9a49fba4dfd9e43eb94037b",
        "target": {
            "file": "include/fastdds/rtps/messages/CDRMessage.h"
        }
    },
    {
        "id": "CVE-2024-30258-174cadbd",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 764.0,
            "function_hash": "217347624671849474259456384404081973754"
        },
        "source": "https://github.com/eprosima/fast-dds/commit/65236f93e9c4ea3ff9a49fba4dfd9e43eb94037b",
        "target": {
            "function": "TEST",
            "file": "test/blackbox/common/BlackboxTestsTransportUDP.cpp"
        }
    },
    {
        "id": "CVE-2024-30258-4b7840d3",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 401.0,
            "function_hash": "294095008979163530671613818131053145694"
        },
        "source": "https://github.com/eprosima/fast-dds/commit/65236f93e9c4ea3ff9a49fba4dfd9e43eb94037b",
        "target": {
            "function": "CDRMessage::readDataHolder",
            "file": "include/fastdds/rtps/messages/CDRMessage.hpp"
        }
    },
    {
        "id": "CVE-2024-30258-5a24fab1",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 377.0,
            "function_hash": "262525771898776156920692576089560801038"
        },
        "source": "https://github.com/eprosima/fast-dds/commit/65236f93e9c4ea3ff9a49fba4dfd9e43eb94037b",
        "target": {
            "function": "CDRMessage::readBinaryPropertySeq",
            "file": "include/fastdds/rtps/messages/CDRMessage.hpp"
        }
    },
    {
        "id": "CVE-2024-30258-5d74fa13",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 369.0,
            "function_hash": "140205806149084880120583991919614964697"
        },
        "source": "https://github.com/eprosima/fast-dds/commit/65236f93e9c4ea3ff9a49fba4dfd9e43eb94037b",
        "target": {
            "function": "CDRMessage::readDataHolderSeq",
            "file": "include/fastdds/rtps/messages/CDRMessage.hpp"
        }
    },
    {
        "id": "CVE-2024-30258-725a5a7b",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "262956306831166481237303932868870361372",
                "306604317174497932475465898607727697833",
                "196513365605387483283372719964676140728",
                "294552922959227129118208678759959282933",
                "233002817893507405036982977419080917531",
                "137118083659526854717517586406070424281"
            ]
        },
        "source": "https://github.com/eprosima/fast-dds/commit/3118cba80c7b0db2c9bd0ede8671e3d31785cbda",
        "target": {
            "file": "src/cpp/rtps/participant/RTPSParticipantImpl.cpp"
        }
    },
    {
        "id": "CVE-2024-30258-775e166c",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "325479319215349449384163022135485467019",
                "25120863698927373074017055353571337052",
                "200987524678677200902251432917657797418",
                "279423547438556605532558726117514485609"
            ]
        },
        "source": "https://github.com/eprosima/fast-dds/commit/65236f93e9c4ea3ff9a49fba4dfd9e43eb94037b",
        "target": {
            "file": "src/cpp/fastdds/core/policy/ParameterSerializer.hpp"
        }
    },
    {
        "id": "CVE-2024-30258-8ac423b2",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "302740093868187649371599939574774869398",
                "147813681107523957982951592158344177433",
                "176166231610126578066245205943537970375",
                "304776172736442350950471226477838560653"
            ]
        },
        "source": "https://github.com/eprosima/fast-dds/commit/65236f93e9c4ea3ff9a49fba4dfd9e43eb94037b",
        "target": {
            "file": "test/blackbox/common/BlackboxTestsTransportUDP.cpp"
        }
    },
    {
        "id": "CVE-2024-30258-aa51cd8c",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "271857784299035488259464956757071186887",
                "73296022482285482584878908299217010544",
                "85188748097507926016339222495618604072",
                "69002559561433045457203629814153949187",
                "275915721060480534131567251006596819548",
                "92190120971699358044898027782029611630",
                "88658749811437547186536992671472623386",
                "292831637602902473873803616346242306955",
                "140195439058633418439672991040218265638",
                "208634670785469284743324892911534866156",
                "55665905113037397877614370237923254979",
                "156108024695924386579226422408310803343",
                "224676036227511891091675806814064212601",
                "291899521742134097900648551173001867802",
                "39247120865013837953149494465853046795",
                "52514128739091292538102494387694709256",
                "228854478080581804833689981858370485021",
                "109271306386299959050609475859833646373",
                "309321364623349040104164600549389321927",
                "95045677004188312636709236212124219009",
                "268952949599762472114446797055503676106",
                "15814462955543322166204168470101735429",
                "58019973322377138494068592351082885264",
                "16461734910066012977713804560236438908",
                "54795957008083545732068677394480103400",
                "179366111137823494428619548774719518154",
                "267615018776176732358813777007572362743",
                "42877913366909668869017622568548510448",
                "201939857286996486016665310585889910369",
                "29236328922804235783008603719073072343",
                "291587697640857175894627501016399727675",
                "32508095957561357927192249073274415796",
                "53665743191748187834210624458043206292",
                "57585148026246352718226651354783628845"
            ]
        },
        "source": "https://github.com/eprosima/fast-dds/commit/65236f93e9c4ea3ff9a49fba4dfd9e43eb94037b",
        "target": {
            "file": "include/fastdds/rtps/messages/CDRMessage.hpp"
        }
    },
    {
        "id": "CVE-2024-30258-d57dca20",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 279.0,
            "function_hash": "113102812975012812755559896456687111370"
        },
        "source": "https://github.com/eprosima/fast-dds/commit/65236f93e9c4ea3ff9a49fba4dfd9e43eb94037b",
        "target": {
            "function": "read_content_from_cdr_message",
            "file": "src/cpp/fastdds/core/policy/ParameterSerializer.hpp"
        }
    },
    {
        "id": "CVE-2024-30258-ecb73c2a",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 6264.0,
            "function_hash": "324427933685653720667523570866654147901"
        },
        "source": "https://github.com/eprosima/fast-dds/commit/3118cba80c7b0db2c9bd0ede8671e3d31785cbda",
        "target": {
            "function": "RTPSParticipantImpl::update_attributes",
            "file": "src/cpp/rtps/participant/RTPSParticipantImpl.cpp"
        }
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-30258.json"