CVE-2022-48837

What it actually does

Integer overflow in rndis_set_response() when a large BufOffset value causes BufOffset + 8 to wrap, allowing invalid buffer calculations and potential memory corruption or out-of-bounds access in the Linux kernel USB gadget RNDIS implementation.

Why it matters to the business

Local attackers on affected Linux or Android-based devices can achieve arbitrary code execution or system compromise through USB gadget interfaces, increasing risk for embedded, mobile, and IoT deployments using RNDIS.

How an attack unfolds

An attacker with local access crafts a malicious RNDIS response packet containing an oversized BufOffset field; when processed by rndis_set_response(), the addition overflows, leading to corrupted state that can be leveraged for code execution, consistent with reported Android kernel RCE patterns.

How to fix it

Upgrade the Linux kernel to a version containing commit 8b3e4d26bc9cd0f6373d0095b9ffd99e7da8006b or later; apply vendor-supplied patches for all affected stable branches and rebuild any custom kernels used in Android or embedded products.

How to confirm the fix worked

Verify the presence of commit 8b3e4d26bc9cd0f6373d0095b9ffd99e7da8006b in the kernel source tree or check that the rndis_set_response() function contains the integer overflow guard; test with crafted large BufOffset inputs in a lab environment.

Typical attack path

1. Obtain local or physical access to the target device
2. Attach or interact with a USB gadget interface exposing RNDIS
3. Send a crafted RNDIS_SET response containing a large BufOffset value
4. Trigger the integer overflow during buffer offset calculation
5. Exploit resulting memory corruption for code execution or privilege escalation

How to detect it

Review kernel logs and USB gadget traces for anomalous RNDIS response handling; search for references to rndis_set_response and large offset values in crash reports or audit logs from devices using Android kernel builds.

What your security team should do

• Prioritize patching all Linux kernels exposing USB gadget RNDIS functionality
• Disable RNDIS gadget support where not required
• Monitor EPSS and threat actor activity for any increase in exploitation attempts
• Include the fix in all Android kernel updates and downstream device firmware releases