USB Gadget RNDIS Vulnerability in Linux Kernel
Summary
GSD-2022-1000850: usb: gadget: rndis: add spinlock for rndis response list. Affects Kernel versions >= f6281af9d62e128aa6efad29cf7265062af114f2, < 4ce247af3f30078d5b97554f1ae6200a0222c15a. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is a widely used open-source operating system kernel that serves as the foundation for various Linux distributions. It provides essential functionality for hardware abstraction, process management, memory management, and device drivers. The USB gadget subsystem in the Linux Kernel enables devices to act as USB peripherals, allowing them to provide various functionalities. One such functionality is the Remote Network Driver Interface Specification (RNDIS), which allows devices to emulate a network interface. However, a vulnerability has been discovered in the RNDIS implementation, which could lead to potential security risks.
Vulnerability Detail
The vulnerability in the USB gadget RNDIS implementation arises from the lack of a spinlock for the RNDIS response list. This can result in race conditions when multiple threads or processes attempt to access and modify the response list simultaneously. An attacker could potentially exploit these race conditions to manipulate the response list, leading to various security issues such as information disclosure, denial of service, or privilege escalation. The vulnerability was introduced in Linux Kernel version 4.6 and has been fixed in version 5.10.103.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the USB gadget RNDIS functionality if it is not required. This can be achieved by modifying the kernel configuration and removing support for the RNDIS gadget driver. However, this workaround may not be feasible in scenarios where RNDIS functionality is essential.
Conclusion
The USB gadget RNDIS vulnerability in the Linux Kernel poses potential security risks due to race conditions in the response list. It is crucial to update the kernel to the fixed version or apply the recommended workaround to mitigate these risks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can potentially be exploited by attackers to manipulate the RNDIS response list, leading to security risks such as information disclosure, denial of service, or privilege escalation.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. It analyzes your package-lock.json file and provides real-time alerts for open-source vulnerabilities.
At the time of this report, there is no known public exploit for this vulnerability. However, it is important to apply the recommended fix to mitigate any potential risks.
As a temporary workaround, you can disable the USB gadget RNDIS functionality if it is not required. However, it is strongly recommended to update the kernel to the fixed version to ensure comprehensive security.
You can refer to the Linux Kernel repository (https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/) for detailed information about the fix. The vulnerability details can be found in the Open Source Vulnerability format at the following link: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1000xxx/GSD-2022-1000850.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
