USB Gadget RNDIS Response List Spinlock Vulnerability in Kernel
Summary
GSD-2022-1000796: usb: gadget: rndis: add spinlock for rndis response list. Affects Kernel versions >= f6281af9d62e128aa6efad29cf7265062af114f2, < da514063440b53a27309a4528b726f92c3cfe56f. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a fundamental component of the Linux operating system that provides core functionalities and interfaces with hardware devices. It acts as a bridge between software applications and the computer's hardware. The USB gadget subsystem in the Kernel allows devices to act as USB peripherals. The RNDIS (Remote Network Driver Interface Specification) is a protocol used for remote network communication. This vulnerability specifically affects the RNDIS implementation in the Kernel's USB gadget subsystem.
Vulnerability Detail
The vulnerability arises from a missing spinlock for the RNDIS response list in the USB gadget RNDIS implementation. Without proper synchronization, concurrent access to the response list can lead to race conditions and potential memory corruption. An attacker with local access to the affected system could exploit this vulnerability to cause a denial-of-service (DoS) condition or potentially execute arbitrary code with elevated privileges. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can apply the patch provided in commit da514063440b53a27309a4528b726f92c3cfe56f manually. Here is an example of the code change:
--- a/drivers/usb/gadget/function/f_rndis.c
+++ b/drivers/usb/gadget/function/f_rndis.c
@@ -123,6 +123,7 @@ struct rndis_response {
struct list_head list;
struct sk_buff *skb;
struct completion done;
+ spinlock_t lock;
};
static struct rndis_response *rndis_dequeue_response(struct rndis_state *state)
Please note that applying patches manually can be error-prone and it is recommended to update to the latest Kernel version instead.
Conclusion
The USB Gadget RNDIS Response List Spinlock Vulnerability in the Kernel's USB gadget RNDIS implementation can potentially lead to a denial-of-service (DoS) condition or arbitrary code execution with elevated privileges. It is crucial to update the Linux Kernel to version v5.15.26 or later to mitigate this vulnerability. Applying the provided patch manually or utilizing the workaround should only be considered if immediate Kernel update is not feasible. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability can range from a denial-of-service (DoS) condition to potential arbitrary code execution with elevated privileges. However, the actual impact and attack plausibility have not been proven yet.
Any system running the Linux Kernel with a version between v4.6 (introduced) and v5.15.25 (exclusive) is affected by this vulnerability if the USB gadget RNDIS functionality is utilized.
No, this vulnerability requires local access to the affected system in order to exploit it.
Yes, a workaround is available by manually applying the patch provided in commit da514063440b53a27309a4528b726f92c3cfe56f. However, it is recommended to update to the latest Kernel version instead.
To fix this vulnerability, update the Linux Kernel to version v5.15.26 or later, which includes the necessary fix for this issue.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
