Chimera

Chimera 硬件仿真与近程利用 为什么 Hak5 的设备又重又显眼。我的手机里有一个完整的 Linux 内核，所以我让它干同样的活——HID 仿真、RNDIS、大容量存储，全套都直接通过 ConfigFS 实现。不需要额外硬件，也不会有线从包里晃出来。 插到目标机器上，选一个 payload，运行。按键直接写入 /dev/hidg0，中间没有任何多余环节。 功能 通过 ConfigFS 实现原生 HID — 完全绕过 Android 的 USB 协议栈，直接把字节写到 /dev/hidg0。速度快，而且大多数 EDR 只会把它当成普通键盘。 设备端 DuckyScript —...

rndis-co

RNDIS-CO 概要 RNDIS USB Gadgetは、パケットフィルタ更新メカニズムを介してカーネルメモリ空間の内容をダンプするために悪用される可能性があります。 説明 RNDISMSGSET USB制御転送リクエストハンドラ - rndissetresponse は genndissetresp を呼び出し、BufOffset + 8 だけオフセットされたバッファポインタを渡します。BufOffset変数はRNDISメッセージから取得され、バッファ境界を尊重するように検証されません。その結果、rndissetmsgtype の4バイトの InformationBufferOffs...

android-gadget

android-gadget 概要 Android で使用される Linux カーネルの一部のリビジョンは、CVE-2021-39685 の影響を受けます。 CVE-2021-39685 の詳細情報と POC は、inspector-gadget リポジトリにあります。 このリポジトリには、Android 固有のいくつかの USB gadget を対象とする POC が含まれています: faccessory faudiosource fgsi fmtp fqcrndis frmnet 説明 a faccessory composite.c で割り当てられる EP0 バッファは...

CVE-2021-28476

CVE-2021-28476: Eine "Microsoft Hyper-V Remote Code Execution Vulnerability" von Gast zu Host in vmswitch.sys. Dies ist ein Proof of Concept für CVE-2021-28476 "Hyper-V Remote Code Execution Vulnerability", einen beliebigen Speicherlesevorgang in vmswitch.sys...

Astra Linux – Vulnerability in Linux 5.15, Linux

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: rndis: prevent integer overflow in rndissetresponse If “BufOffset” is very large, the operation “BufOffset + 8” may lead to an integer overflow...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: frndis: Refactor the bind path to use free After a bind/unbind cycle, the rndis-notifyreq remains stale. If a subsequent bind fails, the unified error handling mechanism attempts to free this stale request. This lead...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: rndis: added a spinlock for the rndis response list There is no lock for the rndis response list. This could lead to list corruption if two different listadd operations occur simultaneously, as described below. It’s...

Linux Distros Unpatched Vulnerability : CVE-2026-68088

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: gadget: function: rndis: add length check to response query Add variable representations for BufLength and BufOffset in rndisqueryresponse, and perform a...

CVE-2026-68088

A flaw was found in the Linux kernel's RNDIS Remote Network Driver Interface Specification gadget function. A missing length check for BufLength and BufOffset parameters within the rndisqueryresponse function could allow a malicious actor to provide specially crafted input. This could lead to...

CVE-2026-68088

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check to response query Add variable representations for BufLength and BufOffset in rndisqueryresponse, and perform a length check on them. This is identical to how rndissetresponse handle...

CVE-2026-68088

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check to response query Add variable representations for BufLength and BufOffset in rndisqueryresponse, and perform a length check on them. This is identical to how rndissetresponse handle...

UBUNTU-CVE-2026-68088

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check to response query Add variable representations for BufLength and BufOffset in rndisqueryresponse, and perform a length check on them. This is identical to how rndissetresponse handle...

EUVD-2026-55269

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check to response query Add variable representations for BufLength and BufOffset in rndisqueryresponse, and perform a length check on them. This is identical to how rndissetresponse handle...

CVE-2026-68088 usb: gadget: function: rndis: add length check to response query

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check to response query Add variable representations for BufLength and BufOffset in rndisqueryresponse, and perform a length check on them. This is identical to how rndissetresponse handle...

CVE-2026-68088

The CVE describes a Linux kernel usb gadget rndis vulnerability where the rndis_query_response() path now validates BufLength and BufOffset (introducing a length check) to match the handling in rndis_set_response(). The vulnerability affects the rndis function of the USB gadget subsystem in the L...

CVE-2026-68088 usb: gadget: function: rndis: add length check to response query

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check to response query Add variable representations for BufLength and BufOffset in rndisqueryresponse, and perform a length check on them. This is identical to how rndissetresponse handle...

CVE-2026-68088

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check to response query Add variable representations for BufLength and BufOffset in rndisqueryresponse, and perform a length check on them. This is identical to how rndissetresponse handle...

SUSE CVE-2026-64505

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check for header Add a length check for the rndis header in rndisrmhdr, to ensure that MessageType, MessageLength, DataOffset, and DataLength fields are present before they are accessed...

CVE-2026-64505

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check for header Add a length check for the rndis header in rndisrmhdr, to ensure that MessageType, MessageLength, DataOffset, and DataLength fields are present before they are accessed...

CVE-2026-64505

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check for header Add a length check for the rndis header in rndisrmhdr, to ensure that MessageType, MessageLength, DataOffset, and DataLength fields are present before they are accessed...