CVE-2025-21734
Published: 27 February 2025
Description
In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Fix copy buffer page size For non-registered buffer, fastrpc driver copies the buffer and pass it to the remote subsystem. There is a problem with current implementation of page size calculation which is not considering the offset in the calculation. This might lead to passing of improper and out-of-bounds page size which could result in memory issue. Calculate page start and page end using the offset adjusted address instead of absolute address.
Security Summary
CVE-2025-21734 is a vulnerability in the Linux kernel's fastrpc driver, specifically affecting the handling of non-registered buffers. When copying buffers to pass to a remote subsystem, the driver incorrectly calculates page size by failing to account for the buffer offset. This results in an improper, out-of-bounds page size being passed, potentially leading to memory corruption issues, classified under CWE-787 (Out-of-bounds Write). The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
A local attacker with low privileges can exploit this vulnerability with low complexity and no user interaction required. Successful exploitation allows high-impact consequences, including unauthorized access to sensitive data (confidentiality), modification of data or code (integrity), and denial of service or system disruption (availability), likely through kernel memory corruption.
Mitigation involves applying the relevant stable kernel patches, as detailed in the upstream commit references. These fixes adjust page start and end calculations to use offset-adjusted addresses instead of absolute addresses, resolving the out-of-bounds issue in the fastrpc driver's buffer copying logic. Security practitioners should update affected Linux kernels promptly, particularly those using the fastrpc subsystem.
Details
- CWE(s)