Vulnerability in DDS Secure Databus Systems Affecting Multiple Vendors

CVE-2023-24010

Summary

An attacker can exploit security weaknesses present in the DDS (Data Distribution Service) configuration to gain unauthorized control over secure databus systems. This vulnerability stems from a flawed implementation of the permission document verification process, specifically involving the OpenSSL PKCS7_verify function. By successfully crafting malicious DDS participants or ROS 2 nodes with valid certificates, an attacker can manipulate the system, presenting a significant risk to data integrity and system functionality. This issue affects various DDS vendors who have not adequately secured their implementation against such configuration vulnerabilities.

References