grimmmbo/ros2_cve-2024-28231Demonstrating the usage of Fastrtps-DDS vulnerability CVE-2024-28231 within Ros2
This repo includes a vulnerable Docker image of ros2 iron based on ubuntu 22 and a matching exploit. We exploit the vulnerability in fastrtps version 2.10.3, enabling denial of service of a remote subscriber via heap buffer overflow.
Fast RTPS version 2.10.3 and dependencies are built from source in folder target in a Docker container, and ros iron is installed.
Disclaimer: This vulnerability was not found by us and is already patched in the upstream repository of Fastdds and ros2 iron. This vulnerability was reproduced for research purposes. This repository is a proof-of-concept code intended for security researchers to reproduce and understand the vulnerability in a controlled environment. Do not run this code on production systems or systems you do not own or have explicit permission to test.
The executable exploit, respectively the file src/exploit.py realize DoS for the next data message it observes after start. You can add an input to specify the attacked ros topic (default is '/chatter') topic.
The script waits for the next message on the topic (on all interfaces except 'lo') and then manipulates and re-sends to the original target.
The prepare_exploit.sh script can be used to generate the exploit executable.
Requirements for attack:
std_msgs/Float32MultiArray.