CVE-2025-21734
Published: 27 February 2025
Summary
CVE-2025-21734 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 1.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-21734 is a vulnerability in the Linux kernel's fastrpc driver, specifically affecting the handling of non-registered buffers. When copying buffers to pass to a remote subsystem, the driver incorrectly calculates page size by failing to account for the buffer offset. This results in an improper, out-of-bounds page size being passed, potentially leading to memory corruption issues, classified under CWE-787 (Out-of-bounds Write). The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
A local attacker with low privileges can exploit this vulnerability with low complexity and no user interaction required. Successful exploitation allows high-impact consequences, including unauthorized access to sensitive data (confidentiality), modification of data or code (integrity), and denial of service or system disruption (availability), likely through kernel memory corruption.
Mitigation involves applying the relevant stable kernel patches, as detailed in the upstream commit references. These fixes adjust page start and end calculations to use offset-adjusted addresses instead of absolute addresses, resolving the out-of-bounds issue in the fastrpc driver's buffer copying logic. Security practitioners should update affected Linux kernels promptly, particularly those using the fastrpc subsystem.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5175
Vulnerability details
In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Fix copy buffer page size For non-registered buffer, fastrpc driver copies the buffer and pass it to the remote subsystem. There is a problem with current implementation of…
more
page size calculation which is not considering the offset in the calculation. This might lead to passing of improper and out-of-bounds page size which could result in memory issue. Calculate page start and page end using the offset adjusted address instead of absolute address.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local kernel memory corruption (out-of-bounds write) in fastrpc driver directly enables privilege escalation by a low-privileged local attacker.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely remediation of the Linux kernel fastrpc driver flaw via patching to directly prevent out-of-bounds write exploitation.
Implements memory protection mechanisms that mitigate unauthorized memory access and corruption from improper page size calculations in buffer handling.
Provides vulnerability scanning to identify systems affected by CVE-2025-21734 in the fastrpc driver for prompt remediation.