CVE-2025-64438: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-64438 is a remotely triggerable Out-of-Memory (OOM) denial-of-service vulnerability in eProsima Fast DDS, a C++ implementation of the DDS (Data Distribution Service) standard. The flaw exists in the RTPS GAP submessage processing logic under RELIABLE QoS and requires no authentication beyond network reachability to the DDS reader. Affected versions include all releases prior to 2.6.11, versions 3.0.0 through 3.3.0 (fixed in 3.3.1), and version 3.4.0 (fixed in 3.4.1). It carries a CVSS v3.1 base score of 7.5 (High) (Feedly, Debian Security Tracker).

The root cause is classified as CWE-835 (Loop with Unreachable Exit Condition / 'Infinite Loop'). In the vulnerable code path, StatefulReader::processGapMsg() iterates over every sequence number in the range [gapStart, gapList.base()) without any upper bound check, calling WriterProxy::irrelevant_change_set() for each and inserting entries into the WriterProxy::changes_received_ (std::set). An attacker can craft a tiny RTPS GAP packet with gapStart set to a low value (e.g., 10) and gapList.base set to INT64_MAX, causing the loop to attempt billions of insertions and driving heap consumption to multi-GB levels. The fix introduces a process_gap() method in WriterProxy that caps the maximum allowed GAP range to 256 entries beyond the current low-water mark (or the known max sequence number from a heartbeat), preventing unbounded iteration (GitHub Commit v3.4.1, GitHub Commit v3.3.1).

Successful exploitation causes rapid, unbounded heap growth in the Fast DDS reader process, leading to process termination via OOM. In environments without RSS limits, memory consumption was observed reaching approximately 64 GB before the process is killed. The impact is limited to availability — there is no confidentiality or integrity compromise — but in robotic, automotive, or industrial IoT systems that rely on Fast DDS for real-time communication (including ROS 2 middleware), process termination can disrupt critical operations (Feedly).

No public proof-of-concept exploit code has been reported, and there is no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.026% (0.000260), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires only network reachability to a DDS reader with no authentication, making it trivially exploitable by any attacker on the same network segment or DDS domain.

1. Reconnaissance: Identify hosts running Fast DDS readers on the target network, particularly those using RELIABLE QoS. DDS discovery traffic (SPDP/SEDP) over UDP multicast (default port 7400) can be passively observed to enumerate participants and their GUIDs.
2. Obtain writer and reader GUIDs: Passively sniff DDS discovery traffic to extract the target reader's GUID prefix and entity ID, and a valid writer GUID prefix to spoof as the packet sender.
3. Craft malicious RTPS GAP packet: Construct a raw RTPS packet containing a GAP submessage (submessage ID 0x08) with gapStart set to a low sequence number (e.g., 10) and gapList.base set to INT64_MAX (or std::numeric_limits<int64_t>::max()), with num_longs_bitmap = 0. Set the sender GUID prefix to the spoofed writer's prefix, and address the packet to the target reader's entity ID.
4. Transmit the packet: Send the crafted UDP packet directly to the reader's unicast locator (IP and port). No prior session establishment or authentication is required.
5. Trigger OOM: The reader's StatefulReader::processGapMsg() enters an unbounded loop iterating from sequence number 10 to INT64_MAX, inserting entries into WriterProxy::changes_received_, causing rapid heap exhaustion and process termination (GitHub Commit v3.4.1, GitHub Commit v3.3.1).

• Network: Unexpected small UDP packets (~60–80 bytes) addressed to a known Fast DDS reader port (e.g., 7000 or 7400) containing RTPS magic bytes (52 54 50 53) with a GAP submessage ID (0x08) and an anomalously large gapList.base value near INT64_MAX.
• Process: Rapid, sustained growth in heap memory usage of the Fast DDS reader process (observable via top, htop, or /proc/<pid>/status VmRSS field); process termination with an OOM kill signal (visible in kernel logs as Out of memory: Kill process).
• Logs: Kernel OOM killer messages in /var/log/syslog or dmesg referencing the Fast DDS process; application crash logs or core dumps from the DDS participant process.
• File System: Unexpected core dump files in the working directory of the Fast DDS application following a crash.

Upgrade Fast DDS to the patched versions: 2.6.11 (for versions prior to 2.6.11), 3.3.1 (for versions 3.0.0–3.3.0), or 3.4.1 (for version 3.4.0). Patches are available via three separate commits on the eProsima Fast-DDS GitHub repository (GitHub Commit v3.4.1, GitHub Commit v3.3.1, GitHub Commit v2.6.11). For systems that cannot be immediately patched, implement network-level controls (firewalls, VLANs) to restrict DDS traffic to trusted participants only, and configure OS-level RSS memory limits (e.g., ulimit -v or cgroup memory limits) on Fast DDS processes to contain the impact of a memory exhaustion attack (Feedly).

Red Hat has acknowledged the vulnerability and published a security advisory tracking it (Red Hat Advisory). The Debian Security Tracker has classified the issue as a minor severity for stable releases (bullseye, bookworm, trixie), with no backported fix planned for those branches (Debian Security Tracker). INCIBE-CERT (Spain's national cybersecurity incident response team) also published an early warning alert for the vulnerability.