CVE-2022-25258: Linux Kernel Buffer Overflow Vulnerability

CVE-2022-25258 Overview

CVE-2022-25258 is a vulnerability in the Linux kernel USB Gadget subsystem affecting versions prior to 5.16.10. The flaw resides in drivers/usb/gadget/composite.c, where the kernel fails to validate interface OS descriptor requests. An attacker with physical access can send crafted USB control requests containing large array indices or requests that trigger NULL function pointer retrieval. The result is memory corruption, classified under [CWE-476] Null Pointer Dereference. The issue impacts mainline Linux distributions including Debian, Fedora, and several NetApp storage appliances that embed the affected kernel.

Critical Impact
Local physical attackers can trigger kernel memory corruption through malformed USB OS descriptor requests, leading to denial of service on affected Linux systems.

Affected Products

Linux Kernel versions prior to 5.16.10
Debian Linux 9.0, 10.0, and 11.0; Fedora 35
NetApp H300S, H500S, H700S, H410S, H410C firmware and Active IQ Unified Manager for VMware vSphere

Discovery Timeline

2022-02-16 - CVE-2022-25258 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-25258

Vulnerability Analysis

The Linux kernel USB Gadget subsystem enables a Linux device to present itself as a USB peripheral to a host. Within drivers/usb/gadget/composite.c, the kernel processes Microsoft OS Descriptor requests sent over USB control transfers. These requests use the w_index and w_value fields of the USB setup packet to specify the target interface and descriptor type.

The vulnerable handler extracted the interface index from w_value & 0xFF and used it to look up an entry in the os_desc_cfg->interface[] array. The code performed no bounds check against MAX_CONFIG_INTERFACES and did not verify the corresponding pointer was non-NULL before dereferencing it. A crafted control request with an out-of-range or unregistered interface index causes the kernel to read past the array or follow a NULL function pointer.

Root Cause

The root cause is missing input validation on attacker-controlled USB setup packet fields. The composite gadget driver trusted the interface byte supplied by the USB host and used it directly as an array subscript without bounds enforcement or NULL checks on the resolved pointer.

Attack Vector

Exploitation requires physical access to a USB port on a system running the affected Linux kernel with the USB Gadget composite driver loaded. The attacker connects a malicious USB host that issues vendor-specific control requests with bRequest=0x5 and a manipulated w_value field. The malformed descriptor request triggers the unvalidated interface lookup, producing kernel memory corruption or a NULL pointer dereference that crashes the host.

                if (w_index != 0x5 || (w_value >> 8))
                    break;
                interface = w_value & 0xFF;
+               if (interface >= MAX_CONFIG_INTERFACES ||
+                   !os_desc_cfg->interface[interface])
+                   break;
                buf[6] = w_index;
                count = count_ext_prop(os_desc_cfg,
                    interface);

Source: Linux Commit 75e5b48. The patch adds two checks: a bounds test against MAX_CONFIG_INTERFACES and a NULL check on the resolved interface pointer before further processing.

Detection Methods for CVE-2022-25258

Indicators of Compromise

Unexpected kernel oops or panic messages in dmesg referencing composite.c or usb_gadget functions following USB device insertion.
System crashes or reboots correlated with attachment of unknown USB peripherals on devices configured as USB gadgets.
Hosts running Linux kernel versions earlier than 5.16.10 with the g_multi, g_ether, or other composite gadget modules loaded.

Detection Strategies

Inventory Linux systems and compare running kernel versions against the 5.16.10 patch level using uname -r across the fleet.
Monitor kernel ring buffer logs for NULL pointer dereference traces originating in USB gadget code paths.
Audit loaded kernel modules for USB gadget composite drivers on systems that do not require USB device-mode functionality.

Monitoring Recommendations

Forward /var/log/kern.log and journald kernel events to a central log platform to correlate USB-related faults across endpoints.
Track USB device connection events using udev rules or usbguard to identify unauthorized peripherals attached to gadget-mode systems.
Alert on repeated kernel crashes on the same host, which may indicate iterative exploitation attempts against the USB stack.

How to Mitigate CVE-2022-25258

Immediate Actions Required

Upgrade affected systems to Linux kernel 5.16.10 or later, or apply the distribution backport patches from Debian DSA-5092, DSA-5096, and the corresponding Fedora update.
Apply NetApp firmware updates referenced in advisory NTAP-20221028-0007 for H-series storage appliances and Active IQ Unified Manager.
Restrict physical access to USB ports on systems operating in USB gadget mode, particularly embedded and appliance deployments.

Patch Information

The upstream fix is recorded in Linux Kernel ChangeLog 5.16.10 and the corresponding upstream commit 75e5b4849b81. Distribution patches are available via Debian DSA-5092, Debian DSA-5096, Debian LTS announcement, and the Fedora package announcement.

Workarounds

Unload USB gadget composite modules on systems that do not require USB device-mode operation using modprobe -r.
Blacklist composite gadget drivers in /etc/modprobe.d/ to prevent automatic loading at boot.
Deploy physical port locks or USB port disablement in BIOS/UEFI on appliances that do not require USB connectivity.

bash

# Disable USB gadget composite module loading
echo 'blacklist libcomposite' | sudo tee /etc/modprobe.d/disable-usb-gadget.conf
sudo update-initramfs -u

# Verify kernel version meets the 5.16.10 patch level
uname -r