CVE-2025-64438
📋 TL;DR
CVE-2025-64438 is a remotely triggerable denial-of-service vulnerability in Fast DDS that allows unauthenticated attackers to cause out-of-memory conditions by sending specially crafted RTPS GAP submessages. This affects all systems running vulnerable versions of Fast DDS with RELIABLE QoS enabled, potentially leading to service disruption and process termination.
💻 Affected Systems
- Fast DDS (formerly Fast RTPS)
📦 What is this software?
Fast Dds by Eprosima
Fast Dds by Eprosima
Fast Dds by Eprosima
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption with process termination due to memory exhaustion, potentially affecting critical DDS-based systems in industrial, automotive, or aerospace applications.
Likely Case
Denial of service affecting DDS communication channels, causing data loss and system instability in affected applications.
If Mitigated
Limited impact with proper network segmentation and memory limits, though some performance degradation may occur.
🎯 Exploit Status
Exploitation requires sending a specially crafted GAP packet with manipulated gap range values.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.4.1, 3.3.1, or 2.6.11
Vendor Advisory: https://github.com/eProsima/Fast-DDS/security/advisories
Restart Required: Yes
Instructions:
1. Identify Fast DDS version currently installed. 2. Upgrade to patched version (3.4.1, 3.3.1, or 2.6.11). 3. Recompile applications using Fast DDS. 4. Restart affected services.
🔧 Temporary Workarounds
Disable RELIABLE QoS
allSwitch to BEST_EFFORT QoS which is not vulnerable to this attack
Modify DDS QoS configuration to use BEST_EFFORT reliability
Implement memory limits
allSet RSS limits to prevent complete memory exhaustion
ulimit -v [LIMIT_IN_KB] (Linux)
Set-ProcessMitigation (Windows)
🧯 If You Can't Patch
- Implement strict network segmentation to isolate DDS traffic from untrusted networks
- Deploy network monitoring to detect and block malicious GAP packets with abnormal gap ranges
🔍 How to Verify
Check if Vulnerable:
Check Fast DDS version and verify if RELIABLE QoS is enabled in configurationCheck Version:
Check build configuration or use package manager: dpkg -l | grep fastdds (Debian/Ubuntu) or rpm -qa | grep fastdds (RHEL/CentOS)Verify Fix Applied:
Verify version is 3.4.1, 3.3.1, or 2.6.11 or higher, and test with simulated GAP packets📡 Detection & Monitoring
Log Indicators:
- Rapid memory consumption spikes
- Process termination due to OOM
- Unusual GAP message patterns
Network Indicators:
- GAP packets with abnormally large gap ranges
- Sudden increase in DDS traffic to specific readers
SIEM Query:
source="fastdds.log" AND ("out of memory" OR "process terminated" OR "gap range")🔗 References
- https://github.com/eProsima/Fast-DDS/commit/0b0cb308eaeeb2175694aa0a0a723106824ce9a7
- https://github.com/eProsima/Fast-DDS/commit/71da01b4aea4d937558984f2cf0089f5ba3c871f
- https://github.com/eProsima/Fast-DDS/commit/8ca016134dac20b6e30e42b7b73466ef7cdbc213
- https://security-tracker.debian.org/tracker/CVE-2025-64438
