CVE-2022-25375 Overview
A memory information disclosure vulnerability exists in the Linux kernel's RNDIS USB gadget driver (drivers/usb/gadget/function/rndis.c). The vulnerability stems from improper validation of the size parameter in RNDIS_MSG_SET commands, allowing attackers with local access to read sensitive information from kernel memory. This affects Linux kernel versions prior to 5.16.10.
Critical Impact
Local attackers can exploit this vulnerability to obtain sensitive information from kernel memory, potentially exposing credentials, cryptographic keys, or other privileged data stored in kernel address space.
Affected Products
- Linux Kernel (versions prior to 5.16.10)
- Debian Linux 9.0
- Debian Linux 10.0
- Debian Linux 11.0
Discovery Timeline
- 2022-02-20 - CVE-2022-25375 published to NVD
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2022-25375
Vulnerability Analysis
The vulnerability resides in the RNDIS (Remote Network Driver Interface Specification) USB gadget driver within the Linux kernel. RNDIS is a Microsoft proprietary protocol used primarily for USB tethering and network communication over USB connections. The vulnerable code path handles RNDIS_MSG_SET commands without properly validating the InformationBufferLength and InformationBufferOffset fields provided by the user.
When processing a maliciously crafted RNDIS_MSG_SET command, the driver would accept oversized buffer length values or out-of-bounds offsets, leading to information disclosure from kernel memory. An attacker with local access to a system running an affected kernel version could exploit this flaw to read arbitrary kernel memory contents.
Root Cause
The root cause is classified as CWE-1284 (Improper Validation of Specified Quantity in Input). The RNDIS driver failed to validate that the InformationBufferLength and InformationBufferOffset values fall within acceptable bounds before processing the RNDIS_MSG_SET command. This missing bounds check allowed attackers to specify values that could cause the driver to access memory beyond the intended buffer boundaries.
Attack Vector
The attack requires local access to the system. An attacker would need to interact with the RNDIS USB gadget interface, sending specially crafted RNDIS_MSG_SET commands with malicious InformationBufferLength or InformationBufferOffset values. The vulnerability allows reading kernel memory contents but does not permit arbitrary code execution or memory writes. Systems most at risk include those configured as USB gadgets (common in embedded systems, mobile devices, and development boards) where an attacker can connect a malicious USB host.
// Security patch adding bounds validation for RNDIS_MSG_SET command
// Source: https://github.com/torvalds/linux/commit/38ea1eac7d88072bbffb630e2b3db83ca649b826
rndis_set_cmplt_type *resp;
rndis_resp_t *r;
+ BufLength = le32_to_cpu(buf->InformationBufferLength);
+ BufOffset = le32_to_cpu(buf->InformationBufferOffset);
+ if ((BufLength > RNDIS_MAX_TOTAL_SIZE) ||
+ (BufOffset + 8 >= RNDIS_MAX_TOTAL_SIZE))
+ return -EINVAL;
+
r = rndis_add_response(params, sizeof(rndis_set_cmplt_type));
if (!r)
return -ENOMEM;
resp = (rndis_set_cmplt_type *)r->buf;
- BufLength = le32_to_cpu(buf->InformationBufferLength);
- BufOffset = le32_to_cpu(buf->InformationBufferOffset);
-
#ifdef VERBOSE_DEBUG
pr_debug("%s: Length: %d\n", __func__, BufLength);
pr_debug("%s: Offset: %d\n", __func__, BufOffset);
Source: Linux Commit 38ea1eac
Detection Methods for CVE-2022-25375
Indicators of Compromise
- Unusual USB gadget activity or unexpected RNDIS device connections
- Anomalous kernel log entries related to rndis.c or USB gadget subsystem
- Evidence of unauthorized access to USB device interfaces on embedded or gadget-mode systems
- Memory disclosure artifacts or unexplained data exfiltration from kernel space
Detection Strategies
- Monitor kernel logs for errors or warnings from the RNDIS USB gadget driver (drivers/usb/gadget/function/rndis.c)
- Implement SentinelOne Singularity Platform for real-time kernel-level monitoring and behavioral analysis
- Deploy endpoint detection rules that flag suspicious USB gadget configuration changes
- Use kernel audit subsystem to track access to USB gadget interfaces
Monitoring Recommendations
- Enable comprehensive logging for USB subsystem events, particularly gadget mode operations
- Implement SentinelOne's Linux agent for continuous monitoring of kernel module behavior
- Establish baseline USB device activity and alert on deviations in gadget-enabled systems
- Monitor for unauthorized physical access to USB ports on embedded systems
How to Mitigate CVE-2022-25375
Immediate Actions Required
- Update Linux kernel to version 5.16.10 or later to obtain the security fix
- For Debian systems, apply the security updates from DSA-5092 and DSA-5096
- If patching is not immediately possible, consider disabling the RNDIS USB gadget functionality
- Restrict physical access to USB interfaces on affected embedded systems
Patch Information
The vulnerability has been addressed in Linux kernel version 5.16.10. The fix adds proper bounds checking for InformationBufferLength and InformationBufferOffset values before processing RNDIS_MSG_SET commands. The patch ensures that buffer lengths do not exceed RNDIS_MAX_TOTAL_SIZE and that offset values remain within valid ranges, returning -EINVAL for invalid inputs.
Vendor Resources:
Workarounds
- Disable RNDIS USB gadget functionality by blacklisting the g_ether or usb_f_rndis kernel modules if not required
- Implement physical security controls to prevent unauthorized USB connections to gadget-enabled devices
- Use kernel module signing to prevent loading of unpatched or malicious kernel modules
- Consider alternative USB network protocols that are not affected by this vulnerability
# Configuration example - Disable RNDIS USB gadget module
# Add to /etc/modprobe.d/blacklist-rndis.conf
echo "blacklist usb_f_rndis" >> /etc/modprobe.d/blacklist-rndis.conf
echo "blacklist g_ether" >> /etc/modprobe.d/blacklist-rndis.conf
# Verify kernel version includes the fix
uname -r
# Should be 5.16.10 or later for upstream kernel
# For Debian systems, update to patched packages
apt update && apt upgrade linux-image-*
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
