CVE-2023-24010 Details
Description
An attacker can arbitrarily craft malicious DDS Participants (or ROS 2 Nodes) with valid certificates to compromise and get full control of the attacked secure DDS databus system by exploiting vulnerable attributes in the configuration of PKCS#7 certificate’s validation. This is caused by a non-compliant implementation of permission document verification used by some DDS vendors. Specifically, an improper use of the OpenSSL PKCS7_verify function used to validate S/MIME signatures.
A vulnerability exists in certain Data Distribution Service (DDS) implementations used by ROS 2, specifically Fast-DDS and CycloneDDS, that allows malicious nodes to forge permission documents. This issue arises from a non-compliant implementation of permission verification, where a single Certificate Authority (CA) is used for both identity and permissions. Exploitation involves crafting a permissions document signed with the node's own certificate, which is then accepted by other nodes due to the shared CA. The vulnerability is rooted in improper validation of S/MIME signatures using OpenSSL, enabling unauthorized delegation of permission signing authority.
DDS vendors should separate the roles of Identity and Permissions CAs into different certificates. Additionally, the verification process should be adjusted to prevent unauthorized delegation of signing authority.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jan 9, 2025CISA-ADP
Assessed Jan 9, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/vmayoral/235c02d0b0ef85a29812eff6980ff80d | CISA-ADP | Exploit |
| https://gist.github.com/vmayoral/235c02d0b0ef85a29812eff6980ff80d | [email protected] | Exploit |
| https://github.com/ros2/sros2/issues/282 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OpenDDS | All versions |
CPE
Remediation
| |
| eProsima Fast-DDS | All versions |
CPE
Remediation
| |
| eclipse-cyclonedds | 0.9.1 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 9, 2025 | CVE Modified | CISA-ADP |
| Jan 9, 2025 | New CVE Received | [email protected] |