OpenDDS Integer Overflow Vulnerability in RTPS Protocol Leading to Denial-of-Service

A denial-of-service vulnerability has been identified in OpenDDS versions prior to 3.33.0, stemming from an integer overflow in the Real-Time Publish-Subscribe (RTPS) protocol implementation. This vulnerability allows attackers to cause a crash by sending crafted messages that exploit the overflow condition.

Impact

Exploitation of this vulnerability leads to a segmentation fault, causing the application to crash.

Reproduction

The vulnerability can be reproduced by sending DATA-FRAG sub messages with manipulated lengths that cause an integer underflow. This can be done by declaring smaller sub message lengths while embedding large amounts of data in the inlineQoS field. The crafted message will be processed in a way that triggers the integer overflow, causing the application to read from an invalid memory location and crash.