CVE-2025-21734 (GCVE-0-2025-21734)
Vulnerability from cvelistv5
Published
2025-02-27 02:12
Modified
2025-05-04 07:20
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Fix copy buffer page size For non-registered buffer, fastrpc driver copies the buffer and pass it to the remote subsystem. There is a problem with current implementation of page size calculation which is not considering the offset in the calculation. This might lead to passing of improper and out-of-bounds page size which could result in memory issue. Calculate page start and page end using the offset adjusted address instead of absolute address.
References
Impacted products
Vendor Product Version
Linux Linux Version: 02b45b47fbe84e23699bb6bdc74d4c2780e282b4
Version: 02b45b47fbe84e23699bb6bdc74d4c2780e282b4
Version: 02b45b47fbe84e23699bb6bdc74d4c2780e282b4
Version: 02b45b47fbe84e23699bb6bdc74d4c2780e282b4
Version: 02b45b47fbe84e23699bb6bdc74d4c2780e282b4
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/misc/fastrpc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c56ba3ea8e3c9a69a992aad18f7a65e43e51d623",
              "status": "affected",
              "version": "02b45b47fbe84e23699bb6bdc74d4c2780e282b4",
              "versionType": "git"
            },
            {
              "lessThan": "c0464bad0e85fcd5d47e4297d1e410097c979e55",
              "status": "affected",
              "version": "02b45b47fbe84e23699bb6bdc74d4c2780e282b4",
              "versionType": "git"
            },
            {
              "lessThan": "24a79c6bc8de763f7c50f4f84f8b0c183bc25a51",
              "status": "affected",
              "version": "02b45b47fbe84e23699bb6bdc74d4c2780e282b4",
              "versionType": "git"
            },
            {
              "lessThan": "c3f7161123fcbdc64e90119ccce292d8b66281c4",
              "status": "affected",
              "version": "02b45b47fbe84e23699bb6bdc74d4c2780e282b4",
              "versionType": "git"
            },
            {
              "lessThan": "e966eae72762ecfdbdb82627e2cda48845b9dd66",
              "status": "affected",
              "version": "02b45b47fbe84e23699bb6bdc74d4c2780e282b4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/misc/fastrpc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            },
            {
              "lessThan": "5.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.129",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.129",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.78",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.14",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.3",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: fastrpc: Fix copy buffer page size\n\nFor non-registered buffer, fastrpc driver copies the buffer and\npass it to the remote subsystem. There is a problem with current\nimplementation of page size calculation which is not considering\nthe offset in the calculation. This might lead to passing of\nimproper and out-of-bounds page size which could result in\nmemory issue. Calculate page start and page end using the offset\nadjusted address instead of absolute address."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T07:20:00.916Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c56ba3ea8e3c9a69a992aad18f7a65e43e51d623"
        },
        {
          "url": "https://git.kernel.org/stable/c/c0464bad0e85fcd5d47e4297d1e410097c979e55"
        },
        {
          "url": "https://git.kernel.org/stable/c/24a79c6bc8de763f7c50f4f84f8b0c183bc25a51"
        },
        {
          "url": "https://git.kernel.org/stable/c/c3f7161123fcbdc64e90119ccce292d8b66281c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/e966eae72762ecfdbdb82627e2cda48845b9dd66"
        }
      ],
      "title": "misc: fastrpc: Fix copy buffer page size",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21734",
    "datePublished": "2025-02-27T02:12:11.663Z",
    "dateReserved": "2024-12-29T08:45:45.756Z",
    "dateUpdated": "2025-05-04T07:20:00.916Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21734\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-27T03:15:14.030\",\"lastModified\":\"2025-02-27T03:15:14.030\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmisc: fastrpc: Fix copy buffer page size\\n\\nFor non-registered buffer, fastrpc driver copies the buffer and\\npass it to the remote subsystem. There is a problem with current\\nimplementation of page size calculation which is not considering\\nthe offset in the calculation. This might lead to passing of\\nimproper and out-of-bounds page size which could result in\\nmemory issue. Calculate page start and page end using the offset\\nadjusted address instead of absolute address.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: misc: fastrpc: Se corrige el tama\u00f1o de p\u00e1gina del b\u00fafer de copia Para un b\u00fafer no registrado, el controlador fastrpc copia el b\u00fafer y lo pasa al subsistema remoto. Hay un problema con la implementaci\u00f3n actual del c\u00e1lculo del tama\u00f1o de p\u00e1gina que no considera el desplazamiento en el c\u00e1lculo. Esto podr\u00eda provocar que se pase un tama\u00f1o de p\u00e1gina incorrecto y fuera de los l\u00edmites, lo que podr\u00eda generar un problema de memoria. Calcule el inicio y el final de la p\u00e1gina utilizando la direcci\u00f3n ajustada por desplazamiento en lugar de la direcci\u00f3n absoluta.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/24a79c6bc8de763f7c50f4f84f8b0c183bc25a51\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c0464bad0e85fcd5d47e4297d1e410097c979e55\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c3f7161123fcbdc64e90119ccce292d8b66281c4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c56ba3ea8e3c9a69a992aad18f7a65e43e51d623\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e966eae72762ecfdbdb82627e2cda48845b9dd66\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.