Critical Vulnerability in Fast DDS: PermissionsCA Validation Flaw
Summary
DEBIAN-CVE-2025-24807: eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Affects fastdds versions < 3.1.2+ds-1. Fixed in 3.1.2+ds-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard defined by the Object Management Group (OMG). It facilitates real-time data exchange in distributed systems, providing features such as low latency and high throughput. However, prior to specific versions, Fast DDS had a vulnerability related to the validation of PermissionsCA, which could lead to security issues.
Vulnerability Detail
The vulnerability arises from the design of Fast DDS, where PermissionsCA is not fully chain validated and its expiration date is not checked. This flaw allows an expired PermissionsCA to be accepted as valid, potentially leading to unauthorized access to governance and permissions. The access control plugin only validates the S/MIME signature, which means that if the PermissionsCA is not self-signed and lacks the full chain, it can cause the system to crash. Although the impact is considered low, it poses risks in environments relying on proper permissions management.
How To Fix
Minimum fixed version
3.1.2+ds-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade fastddsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using expired PermissionsCA and ensure that all PermissionsCA are self-signed and include the full chain. This can help mitigate the risk until the package is updated to a secure version.
Conclusion
The vulnerability in Fast DDS regarding PermissionsCA validation poses a risk, albeit low, to systems relying on proper permissions management. Users are advised to update to the latest patched versions to mitigate this risk effectively.
See every vulnerability recorded for fastdds →
FAQ
Fast DDS is a C++ implementation of the DDS standard, enabling efficient data distribution in real-time applications.
The vulnerability involves inadequate validation of PermissionsCA, allowing expired certificates to be accepted as valid.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The main consequence is the potential for unauthorized access to governance and permissions, which could lead to system crashes.
Regularly update your packages to the latest versions and monitor for vulnerabilities using tools like Vulert.
References
Related vulnerabilities
Recent vulnerabilities recorded for fastdds.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
