CVE-2022-25375 Overview
CVE-2022-25375 is an information disclosure vulnerability in the Linux kernel's RNDIS USB gadget driver. The flaw resides in drivers/usb/gadget/function/rndis.c and affects Linux kernel versions before 5.16.10. The RNDIS USB gadget fails to validate the size of the RNDIS_MSG_SET command, allowing local attackers to read sensitive data from kernel memory. The vulnerability is classified under [CWE-1284] (Improper Validation of Specified Quantity in Input). Debian distributions versions 9, 10, and 11 are also impacted and received fixes through dedicated security advisories.
Critical Impact
Local attackers with low privileges can leak sensitive kernel memory contents through crafted RNDIS messages, potentially exposing credentials, keys, or pointers useful for further exploitation.
Affected Products
- Linux kernel versions prior to 5.16.10
- Debian Linux 9, 10, and 11
- Systems using the RNDIS USB gadget function driver
Discovery Timeline
- 2022-02-20 - CVE-2022-25375 published to NVD
- 2022-02-21 - Disclosed on the OpenWall oss-security mailing list
- 2022-03 - Debian LTS security advisories DSA-5092 and DSA-5096 released
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2022-25375
Vulnerability Analysis
The vulnerability exists in the Remote Network Driver Interface Specification (RNDIS) USB gadget implementation within the Linux kernel. RNDIS is a Microsoft proprietary protocol used to provide network communication over USB. When the kernel processes an RNDIS_MSG_SET command, it does not properly validate the declared length fields against the actual message buffer size.
An attacker who can send crafted RNDIS control messages to the gadget driver can supply length values that cause the kernel to read beyond the intended buffer. The resulting response or behavior leaks adjacent kernel memory contents to the attacker. This is a kernel-level memory disclosure, which can expose pointers, cryptographic material, or other privileged data.
Root Cause
The rndis_set_response() function in drivers/usb/gadget/function/rndis.c accepted the BufOffset and InformationBufferLength fields from the incoming RNDIS message without verifying that they fit within the received message size. The upstream fix in commit 38ea1eac7d88072bbffb630e2b3db83ca649b826 adds bounds checking to ensure the requested data region falls entirely within the message buffer before access.
Attack Vector
Exploitation requires local access with the ability to interact with the RNDIS gadget interface. This typically applies to systems configured as USB gadgets, such as embedded devices, development boards, or Android-like configurations where the host can issue RNDIS control transfers. A successful attacker triggers the unchecked size handling by sending an RNDIS_MSG_SET message with malicious offset and length fields, then reads the response containing leaked kernel memory.
A public proof-of-concept is published in the rndis-co repository on GitHub, demonstrating the unchecked length handling.
Detection Methods for CVE-2022-25375
Indicators of Compromise
- Unexpected loading or use of the g_ether, g_multi, or other RNDIS-capable gadget modules on systems that should not function as USB gadgets
- Anomalous RNDIS control transfers containing oversized InformationBufferLength or BufOffset values
- Unprivileged processes interacting with /dev/usb-ffs/ or configfs gadget endpoints unexpectedly
Detection Strategies
- Audit running kernel versions against the 5.16.10 baseline and Debian DSA-5092 / DSA-5096 patch levels
- Monitor modprobe and insmod activity for RNDIS gadget modules on production systems
- Inspect USB gadget configuration in /sys/kernel/config/usb_gadget/ for unauthorized function bindings
Monitoring Recommendations
- Enable kernel auditd rules for syscalls touching USB gadget configfs paths
- Correlate dmesg output for RNDIS-related warnings or unexpected gadget enumeration events
- Track local user activity on embedded and developer systems that expose USB gadget functionality
How to Mitigate CVE-2022-25375
Immediate Actions Required
- Upgrade the Linux kernel to version 5.16.10 or later on all affected systems
- Apply Debian security updates from DSA-5092 and DSA-5096 for Debian 9, 10, and 11 hosts
- Unload and blacklist the RNDIS gadget modules on systems that do not require USB gadget functionality
Patch Information
The upstream fix is available in Linux commit 38ea1eac7d88072bbffb630e2b3db83ca649b826 and included in the Kernel ChangeLog 5.16.10. Debian users should reference DSA-5092 and DSA-5096 for distribution-specific package updates.
Workarounds
- Disable the RNDIS USB gadget by blacklisting usb_f_rndis in /etc/modprobe.d/ where the feature is not required
- Restrict physical and local access to systems that expose USB gadget interfaces
- Remove RNDIS function bindings from configfs-based gadget configurations until the patch is applied
# Blacklist the vulnerable RNDIS gadget module
echo "blacklist usb_f_rndis" | sudo tee /etc/modprobe.d/disable-rndis.conf
sudo depmod -a
sudo update-initramfs -u
# Verify kernel version meets the patched baseline
uname -r
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
