Chimera

Chimera Hardware Emulation & Proximity Exploitation Why Hak5 gear is heavy and obvious. My phone has a full Linux kernel in it, so I made it do the same job — HID emulation, RNDIS, mass storage, the whole thing — straight through ConfigFS. No extra hardware. No cables dangling out of a bag. Plug...

android-gadget

android-gadget Summary Certain revisions of the Linux kernel used in Android are affected by issue CVE-2021-39685. Detailed information and a POC for CVE-2021-39685 may be found in the inspector-gadget repository. This repository includes POC targeting few Android specific USB gadgets including:...

rndis-co

RNDIS-CO Summary The RNDIS USB Gadget may be exploited to dump contents of kernel memory space via packet filter update mechanism. Description The RNDISMSGSET usb control transfer request handler - rndissetresponse calls genndissetresp passing a buffer pointer offset by BufOffset + 8. The BufOffs...

CVE-2021-28476

CVE-2021-28476: a guest-to-host "Microsoft Hyper-V Remote Code Execution Vulnerability" in vmswitch.sys. This is a proof of concept for CVE-2021-28476 "Hyper-V Remote Code Execution Vulnerability", an arbitrary memory read in vmswitch.sys network virtualization service provider patched by Microso...

NXP MCUXpresso SDK USB Middleware Before 2.13.0 RNDIS Out-of-Bounds Read

NXP MCUXpresso SDK USB middleware versions before 2.13.0 contain an out-of-bounds read in USBDeviceCdcRndisSetCommand that can disclose device memory through crafted RNDIS SET messages...

CVE-2026-116487

NXP MCUXpresso SDK USB middleware mcuxsdk-middleware-usb before 2.13.0 contains an out-of-bounds read vulnerability in USBDeviceCdcRndisSetCommand that trusts a host-supplied informationBufferOffset. A malicious USB host can send RNDIS SET messages for OIDGENCURRENTPACKETFILTER or...

EUVD-2026-109814

NXP MCUXpresso SDK USB middleware mcuxsdk-middleware-usb before 2.13.0 contains an out-of-bounds read vulnerability in USBDeviceCdcRndisSetCommand that trusts a host-supplied informationBufferOffset. A malicious USB host can send RNDIS SET messages for OIDGENCURRENTPACKETFILTER or...

CVE-2026-116487 NXP MCUXpresso SDK USB Middleware before 2.13.0 RNDIS Out-of-Bounds Read

NXP MCUXpresso SDK USB middleware mcuxsdk-middleware-usb before 2.13.0 contains an out-of-bounds read vulnerability in USBDeviceCdcRndisSetCommand that trusts a host-supplied informationBufferOffset. A malicious USB host can send RNDIS SET messages for OIDGENCURRENTPACKETFILTER or...

Astra Linux - vulnerability in linux

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: rndis: prevent integer overflow in rndissetresponse If “BufOffset” is very large, the “BufOffset + 8” operation may result in an integer overflow...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: frndis: Refactor bind path to use free After a bind/unbind cycle, the rndis-notifyreq remains stale. If a subsequent bind fails, the unified error label attempts to free this stale request, resulting in a NULL pointe...

Astra Linux – vulnerability in linux-5.10, linux

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: rndis: add spinlock for rndis response list There is no lock protecting the rndis response list. This can lead to list corruption if two different listadd operations occur simultaneously, as shown below. It is better...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: added a length check for the header A length check has been added to the rndisheader in rndisrmhdr, to ensure that the MessageType, MessageLength, DataOffset, and DataLength fields are present before...

CVE-2026-83788

Buffer over-read in Windows RNDIS allows an unauthorized attacker to disclose information with a physical attack...

EUVD-2026-99999

Buffer over-read in Windows RNDIS allows an unauthorized attacker to disclose information with a physical attack...

CVE-2026-83788

A buffer over-read vulnerability exists in the Windows RNDIS component, specifically within rndismp6.sys . This flaw allows an unauthorized attacker to perform an information disclosure by conducting a physical attack . No specific exploit details or in-the-wild exploitation information are provi...

Windows rndismp6.sys Information Disclosure Vulnerability

Buffer over-read in Windows RNDIS allows an unauthorized attacker to disclose information with a physical attack...

PT-2026-112582

Name of the Vulnerable Software and Affected Versions Windows RNDIS affected versions not specified Description A buffer over-read exists in Windows RNDIS, which allows an unauthorized attacker to disclose sensitive information through a physical attack. A buffer over-read occurs when a program...

CVE-2026-83788: Buffer Over-read

Buffer over-read in Windows RNDIS allows an unauthorized attacker to disclose information with a physical attack...

Astra Linux – Vulnerability in Linux 5.10, Linux

In rndisqueryoid in drivers/net/wireless/rndiswlan.c within the Linux kernel, from version 6.1.5 onwards, there is an integer overflow in a mathematical operation...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: usb: rndishost: The secure rdrisquery check prevents integer overflow. The variables off and len, which are typed as uint32 in the rdrisquery function, are controlled by the incoming RNDIS response message. Therefore, their value...