CVE-2022-25375

Katalog CVE

CVSS 5.5 · Medium EPSS 1,1%

Kerentanan Improper Validation of Specified Quantity in Input pada linux kernel, debian linux. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

An issue was discovered in drivers/usb/gadget/function/rndis.c in the Linux kernel before 5.16.10. The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive information from kernel memory.

Rincian

Terbit di NVD

20 Februari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1284: Improper Validation of Specified Quantity in Input

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 63,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.10 patch · release notes · advisory vendor
• http://www.openwall.com/lists/oss-security/2022/02/21/1 mailing list · patch · advisory pihak ketiga
• https://github.com/torvalds/linux/commit/38ea1eac7d88072bbffb630e2b3db83ca649b826 patch · advisory pihak ketiga
• https://github.com/szymonh/rndis-co advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html mailing list · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html mailing list · advisory pihak ketiga
• https://www.debian.org/security/2022/dsa-5092 advisory pihak ketiga
• https://www.debian.org/security/2022/dsa-5096 advisory pihak ketiga