CVE-2023-23559 Overview
CVE-2023-23559 is an integer overflow vulnerability in the rndis_query_oid function within drivers/net/wireless/rndis_wlan.c of the Linux kernel. The flaw affects all Linux kernel versions up to and including 6.1.5. An addition operation in the RNDIS (Remote Network Driver Interface Specification) wireless driver lacks proper bounds checking, allowing an integer overflow. This weakness is classified as [CWE-190] Integer Overflow or Wraparound. Local attackers with low privileges can exploit the issue to compromise kernel memory integrity, leading to potential code execution or system crash. The vulnerability also impacts Debian Linux 10 and NetApp HCI Baseboard Management Controller products that ship affected kernel components.
Critical Impact
Local attackers can trigger an integer overflow in the kernel RNDIS wireless driver, enabling memory corruption with high confidentiality, integrity, and availability impact.
Affected Products
- Linux Kernel versions through 6.1.5
- Debian Linux 10.0
- NetApp HCI Baseboard Management Controller (H300S, H410C, H410S, H500S, H700S)
Discovery Timeline
- 2023-01-13 - CVE-2023-23559 published to NVD
- 2025-05-05 - Last updated in NVD database
Technical Details for CVE-2023-23559
Vulnerability Analysis
The vulnerability resides in the rndis_query_oid function inside the rndis_wlan.c driver, which handles RNDIS object identifier (OID) queries for USB-attached wireless devices. The function performs an addition operation on length values returned from the device without validating that the result fits within the expected bounds. When the sum exceeds the maximum value of the integer type, the result wraps around, producing a smaller value than intended. Subsequent memory operations rely on this miscalculated length, leading to out-of-bounds memory access in kernel space. Exploitation grants attackers high impact across confidentiality, integrity, and availability of the affected system.
Root Cause
The root cause is unchecked arithmetic on attacker-controllable length fields parsed from RNDIS response messages. The driver adds offset and length values supplied by the device without verifying that the addition does not overflow the integer type. A malicious USB RNDIS device, or a crafted response replayed through other means, can supply values whose sum wraps to a smaller integer. The driver then uses this truncated value as the basis for memory copy operations, corrupting kernel buffers.
Attack Vector
The attack vector is local. An attacker requires low privileges and physical or virtual access to attach a malicious USB device that registers itself as an RNDIS wireless adapter. When the kernel queries the device using rndis_query_oid, the device returns crafted length and offset fields that trigger the integer overflow. No user interaction beyond device attachment is required. The upstream fix is published in the Linux Kernel Commit b870e73a and discussed in the Linux Wireless Patch Submission.
No verified public proof-of-concept code is available. The vulnerability manifests during length calculation in rndis_query_oid when summing device-supplied fields. See the upstream commit referenced above for the exact lines and the corrected bounds checks.
Detection Methods for CVE-2023-23559
Indicators of Compromise
- Unexpected kernel oops or panic messages referencing rndis_wlan or rndis_query_oid in dmesg and /var/log/kern.log.
- Sudden disconnection or repeated re-enumeration of USB wireless adapters identifying as RNDIS devices.
- Kernel memory corruption signatures reported by KASAN (Kernel Address Sanitizer) when enabled.
Detection Strategies
- Inventory running kernel versions across Linux endpoints and servers and flag hosts running kernels at or below 6.1.5.
- Monitor udev and kernel logs for RNDIS device attachment events on systems where such devices are not expected.
- Correlate USB device insertion events with subsequent kernel error messages from the wireless subsystem.
Monitoring Recommendations
- Enable kernel auditing for USB device attach events using auditd rules targeting /dev/bus/usb.
- Forward kernel logs to a centralized logging platform and alert on rndis_wlan driver faults.
- Track package versions of linux-image-* on Debian systems and validate they include the backported fix.
How to Mitigate CVE-2023-23559
Immediate Actions Required
- Update the Linux kernel to a version that contains the upstream fix from Linux Kernel Commit b870e73a.
- Apply Debian security updates referenced in Debian LTS Advisory #0005 and Debian LTS Advisory #0006.
- Review the NetApp Security Advisory NTAP-20230302-0003 for HCI Baseboard Management Controller remediation steps.
Patch Information
The upstream patch adds proper bounds checking to the addition in rndis_query_oid, preventing overflow of the length calculation. Debian backported the fix in its May 2023 LTS advisories. NetApp issued vendor-specific updates for affected HCI Baseboard Management Controller models. Administrators should validate kernel version using uname -r and confirm the installed package includes the fix commit b870e73a56c4cccbec33224233eaf295839f228c.
Workarounds
- Blacklist the rndis_wlan kernel module on systems that do not require RNDIS wireless USB devices.
- Restrict physical and virtual USB access on sensitive systems using USB authorization policies under /sys/bus/usb/devices/*/authorized.
- Disable automatic loading of unused USB network drivers through modprobe configuration files in /etc/modprobe.d/.
# Disable the vulnerable RNDIS wireless driver
echo "blacklist rndis_wlan" | sudo tee /etc/modprobe.d/disable-rndis_wlan.conf
sudo update-initramfs -u
# Verify the module is not loaded after reboot
lsmod | grep rndis_wlan
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
