CVE-2024-26369: 
Linux Debian vulnerability analysis and mitigation

An issue in the HistoryQosPolicy component of FastDDS v2.12.x, v2.11.x, v2.10.x, and v2.6.x leads to a SIGABRT (signal abort) upon receiving DataWriter's data. The vulnerability was discovered in February 2024 and assigned CVE-2024-26369 (NVD).

The vulnerability occurs when setting depth = 0 and kind = KEEP_LAST_HISTORY_QOS for DataReader's HistoryQosPolicy, which causes the program to abort upon receiving DataWriter's data. The issue has been assigned a CVSS 3.1 Base Score of 7.5 HIGH with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (NVD). The vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption).

When exploited, this vulnerability causes a SIGABRT (signal abort) in the affected application, leading to a denial of service condition. The issue affects applications using FastDDS for data communication, particularly those implementing specific HistoryQosPolicy configurations (GitHub Issue).

To exploit the vulnerability, an attacker needs to trigger the DataReader to receive data while having the HistoryQosPolicy configured with depth = 0 and kind = KEEP_LAST_HISTORY_QOS. The vulnerability requires no special privileges or user interaction to be exploited (NVD).

A fix has been implemented that introduces checks to ensure the history QoS is consistent in both DataWriter and DataReader creation. The fix verifies that if history kind is set as KEEP_LAST, the history depth must be higher than zero. The patch also includes checks between history depth and resource limits' max_samples_per_instance (GitHub PR).

The vulnerability caused significant disruption to ROS2 workspaces, with users reporting errors when calling rclcpp::Node::make_shared. In response, the ROS 2 Rolling ros2.repos file was updated to pin Fast DDS to the commit previous to the vulnerability fix (GitHub PR).