CVE-2023-54110

What it actually does

Integer overflow in rndis_query allows off + len + 8 calculation to bypass bounds check, causing response pointer to reference memory past expected buffer and enabling out-of-bounds read of kernel data via specific OIDs such as RNDIS_OID_802_3_PERMANENT_ADDRESS.

Why it matters to the business

Attackers with ability to supply malicious RNDIS responses over USB can obtain sensitive kernel memory contents, increasing risk of information leakage on systems that process untrusted USB devices.

How an attack unfolds

An attacker presents a crafted RNDIS response message with an unexpectedly large off value; the uint32 arithmetic overflows, validation is skipped, and the resulting pointer dereference returns memory contents beyond the allocated response buffer.

How to fix it

Apply the upstream kernel patch that changes off and len handling to prevent the integer overflow; rebuild and deploy updated kernel images on all affected systems.

How to confirm the fix worked

Confirm the fix is present by inspecting the rndis_query function for explicit overflow-safe arithmetic or bounds checks before pointer arithmetic; test with a crafted RNDIS response containing maximum uint32 off value.

Typical attack path

1. Connect malicious or compromised USB device presenting RNDIS interface
2. Send RNDIS response with manipulated off and len fields to trigger overflow
3. Request OID that triggers the vulnerable read path
4. Receive leaked kernel memory in response data

How to detect it

Review kernel USB and RNDIS logs for unexpected response lengths or OID queries; correlate with device insertion events from untrusted sources; no specific post-exploitation artifacts are typically left on disk.

What your security team should do

• Prioritize kernel updates on systems that expose USB RNDIS interfaces to untrusted devices
• Disable RNDIS host support where not required
• Monitor EPSS and KEV status for any future increase in exploit activity