CVE-2022-25375

What it actually does

Missing bounds check on RNDIS_MSG_SET command size in the USB gadget RNDIS driver permits an out-of-bounds kernel memory read, disclosing arbitrary kernel memory contents to a local process.

Why it matters to the business

Systems exposing the RNDIS USB gadget interface risk leakage of kernel memory that may contain credentials, encryption keys, or other sensitive data; the flaw has been public for years with a stable fix available.

How an attack unfolds

An attacker with the ability to interact with the RNDIS USB gadget function sends a crafted RNDIS_MSG_SET command whose length field exceeds the actual buffer, causing the driver to copy uninitialized kernel memory back to user space.

How to fix it

Upgrade the Linux kernel to a version containing commit 38ea1eac7d88072bbffb630e2b3db83ca649b826 or later; rebuild and redeploy any custom kernels or distributions that include the vulnerable rndis.c driver.

How to confirm the fix worked

Confirm the running kernel contains commit 38ea1eac7d88072bbffb630e2b3db83ca649b826 by inspecting /proc/version or the kernel source tree; attempt to reproduce the information leak with a proof-of-concept that exercises the RNDIS_MSG_SET path and verify the leak no longer occurs.

Typical attack path

1. Obtain local access or control of a process that can open the RNDIS gadget character device
2. Craft a malicious RNDIS_MSG_SET control message with an oversized length field
3. Submit the message via the gadget interface and receive the leaked kernel memory in the response
4. Parse the returned data for sensitive material such as cryptographic material or credentials

How to detect it

Review kernel logs for unusual RNDIS gadget activity or memory-corruption warnings; examine audit logs for processes that open USB gadget character devices and inspect any captured USB traffic for oversized RNDIS control messages.

What your security team should do

• Prioritize kernel updates on any hosts that expose USB gadget functionality, especially embedded or Android devices
• Audit device configurations to determine whether the RNDIS gadget driver is enabled and can be disabled if not required
• Monitor upstream kernel changelogs for any follow-on fixes related to USB gadget drivers