CVE-2021-38425 — Insufficient Control of Network Message Volume (Network Amplification) in Fast DDS

CWE-406 — Insufficient Control of Network Message Volume (Network Amplification)7 documents6 sources
Severity
9.1CRITICALNVD
CNA7.5
EPSS
0.1%
top 75.07%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Eprosima Fast DDS
Timeline
PublishedMay 5
Latest updateAug 24

Description

eProsima Fast DDS versions prior to 2.4.0 (#2269) are susceptible to exploitation when an attacker sends a specially crafted packet to flood a target device with unwanted traffic, which may result in a denial-of-service condition and information exposure.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HExploitability: 3.9 | Impact: 5.2

Affected Packages2 packages

▶CVEListV5eprosima/fast_ddsunspecified — 2.4.0 (#2269)
▶NVDeprosima/fast_dds< 2.4.0

🔴Vulnerability Details

4
OSV
fastdds vulnerabilities↗2023-08-24
▶
GHSA
GHSA-6x94-8g2r-qg72: eProsima Fast DDS versions prior to 2↗2022-05-06
▶
CVEList
eProsima Fast DDS Network Amplification↗2022-05-05
▶
OSV
CVE-2021-38425: eProsima Fast DDS versions prior to 2↗2022-05-05
▶

📋Vendor Advisories

2
Ubuntu
Fast DDS vulnerabilities↗2023-08-24
▶
Debian
CVE-2021-38425: fastdds - eProsima Fast DDS versions prior to 2.4.0 (#2269) are susceptible to exploitatio...↗2021
▶
CVE-2021-38425 — Eprosima Fast DDS vulnerability | cvebase