CVE-2023-54110

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: rndis_host: Secure rndis_query check against int overflow

Variables off and len typed as uint32 in rndis_query function

are controlled by incoming RNDIS response message thus their

value may be manipulated. Setting off to a unexpectetly large

value will cause the sum with len and 8 to overflow and pass

the implemented validation step. Consequently the response

pointer will be referring to a location past the expected

buffer boundaries allowing information leakage e.g. via

RNDIS_OID_802_3_PERMANENT_ADDRESS OID.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References