CVE-2022-48938

What it actually does

An integer overflow in CDC-NCM sanity checks for fragment offset and length allows a broken or malicious USB device to bypass validation when extreme offsets like 0xFFF0 are supplied, defeating the intended bounds check and potentially causing kernel instability or denial of service.

Why it matters to the business

Affected Linux-based systems and Android devices may experience crashes or loss of USB network connectivity when certain devices are attached, leading to operational downtime and requiring kernel updates across fleets.

How an attack unfolds

An attacker with local access supplies a malicious CDC-NCM USB device that presents crafted fragments containing extreme offsets; the unchecked addition of offset plus length overflows, bypassing the sanity test and allowing invalid data to reach the network stack, resulting in a crash.

How to fix it

Upgrade Linux kernel to version 4.19.323 or apply commit a612395c7631918e0e10ea48b9ce5ab4340f26a6; for Android devices apply SoCVersion dated 2021-12-05 or newer; disable unnecessary CDC-NCM USB support where feasible until patched.

How to confirm the fix worked

Confirm the running kernel contains the fix by checking version strings or the presence of the updated offset/length validation logic; test with a device that previously supplied extreme offsets to verify the check no longer overflows.

Typical attack path

1. Obtain local access or the ability to attach USB devices
2. Present a malicious CDC-NCM USB gadget with extreme fragment offset values
3. Trigger the integer overflow in the driver's sanity check
4. Cause kernel panic or denial of service

How to detect it

Review kernel logs and dmesg output for CDC-NCM related crashes or warnings around USB attach events; correlate with system uptime and recent device insertions.

What your security team should do

• Apply the listed kernel and Android fixes immediately on all affected systems
• Inventory devices that expose CDC-NCM interfaces and prioritize patching
• Restrict untrusted USB device attachment until updates are deployed
• Monitor kernel logs for CDC-NCM related panics during the remediation window