CVE-2022-25375: Medium severity android vulnerability
An issue was discovered in drivers/usb/gadget/function/rndis.c in the Linux kernel before 5.16.10. The RNDIS USB gadget lacks validation of the size of the RNDISMSGSET command. Attackers can obtain sensitive information from kernel memory.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-25375?
CVE-2022-25375 has been classified as a vulnerability that can lead to the exposure of sensitive information from kernel memory.
How do I fix CVE-2022-25375?
To fix CVE-2022-25375, upgrade to Linux kernel versions 5.16.10 or later or apply the appropriate security patches for your distribution.
Which systems are affected by CVE-2022-25375?
CVE-2022-25375 affects the Linux kernel before version 5.16.10 and certain versions of Debian Linux, as well as Google Android.
What type of exploitation is possible with CVE-2022-25375?
CVE-2022-25375 allows attackers to obtain sensitive information from kernel memory due to improper validation in the RNDIS USB gadget.
Is CVE-2022-25375 exploitable remotely?
Yes, CVE-2022-25375 could potentially be exploited remotely by sending specially crafted RNDIS messages.