CVE-2022-20423

What it actually does

Out of bounds write due to integer overflow in rndis_set_response of rndis.c, enabling local privilege escalation via malicious USB device attachment.

Why it matters to the business

Devices remain exposed to local privilege escalation when connecting to untrusted USB hardware; widespread kernel-level impact across Android ecosystem increases operational risk for mobile and embedded deployments.

How an attack unfolds

An attacker prepares a malicious USB device that triggers the integer overflow during RNDIS response processing; upon physical connection the overflow writes outside bounds, granting elevated privileges without user interaction.

How to fix it

Apply upstream kernel patches addressing the integer overflow in rndis.c; vendors should backport the fix to all supported Android kernel branches and release updated builds.

How to confirm the fix worked

Confirm kernel source contains the corrected rndis_set_response bounds check; test with a controlled malicious RNDIS device in a lab environment to verify no overflow occurs.

Typical attack path

1. Craft malicious USB device to send oversized or malformed RNDIS response
2. Attach device to target Android system
3. Trigger rndis_set_response path to cause integer overflow and out-of-bounds write
4. Execute code with elevated privileges

How to detect it

Review kernel logs for RNDIS driver anomalies or unexpected privilege changes following USB attachment events; correlate with physical access timestamps in audit trails.

What your security team should do

• Prioritize kernel updates on all Android devices that support USB RNDIS
• Enforce USB device allow-listing or disable RNDIS where feasible
• Monitor vendor security bulletins for backported fixes