Chimera

Chimera Hardware Emulation & Proximity Exploitation Why Hak5 gear is heavy and obvious. My phone has a full Linux kernel in it, so I made it do the same job — HID emulation, RNDIS, mass storage, the whole thing — straight through ConfigFS. No extra hardware. No cables dangling out of a bag. Plug...

android-gadget

android-gadget 요약 Android에서 사용되는 일부 Linux 커널 개정판이 CVE-2021-39685 문제의 영향을 받습니다. CVE-2021-39685에 대한 자세한 정보와 PoC는 inspector-gadget 리포지토리에서 확인할 수 있습니다. 이 리포지토리는 Android 특정 USB 가젯 중 일부를 대상으로 하는 PoC를 포함합니다: faccessory faudiosource fgsi fmtp fqcrndis frmnet 설명 a faccessory composite.c에 할당된 EP0 버퍼는...

rndis-co

RNDIS-CO 概要 RNDIS USB Gadgetは、パケットフィルタ更新メカニズムを介してカーネルメモリ空間の内容をダンプするために悪用される可能性があります。 説明 RNDISMSGSET USB制御転送リクエストハンドラ - rndissetresponse は genndissetresp を呼び出し、BufOffset + 8 だけオフセットされたバッファポインタを渡します。BufOffset変数はRNDISメッセージから取得され、バッファ境界を尊重するように検証されません。その結果、rndissetmsgtype の4バイトの InformationBufferOffs...

CVE-2021-28476

CVE-2021-28476: a guest-to-host "Microsoft Hyper-V Remote Code Execution Vulnerability" in vmswitch.sys. This is a proof of concept for CVE-2021-28476 "Hyper-V Remote Code Execution Vulnerability", an arbitrary memory read in vmswitch.sys network virtualization service provider patched by Microso...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: rndis: prevent integer overflow in rndissetresponse If “BufOffset” is very large, the operation “BufOffset + 8” may lead to an integer overflow...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: frndis: Refactor the bind path to use free After a bind/unbind cycle, the rndis-notifyreq remains stale. If a subsequent bind fails, the unified error handling mechanism attempts to free this stale request. This lead...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: rndis: added a spinlock for the rndis response list There is no lock for the rndis response list. This could lead to list corruption if two different listadd operations occur simultaneously, as described below. It’s...

CVE-2026-69768

Heap-based buffer overflow in Windows RNDIS allows an unauthorized attacker to execute code over a network...

CVE-2026-69548

Heap-based buffer overflow in Windows RNDIS allows an unauthorized attacker to disclose information with a physical attack...

EUVD-2026-73602

Heap-based buffer overflow in Windows RNDIS allows an unauthorized attacker to execute code over a network...

CVE-2026-69768

A heap-based buffer overflow in Windows RNDIS (Remote Network Driver Interface Specification) allows an unauthorized, network-based attacker to achieve remote code execution without user interaction or prior privileges. Microsoft assigned a CVSS 3.1 score of 9.8 (Critical) , reflecting high impac...

CVE-2026-69548

CVE-2026-69548 is a heap-based buffer overflow in Windows RNDIS that allows an unauthorized attacker to disclose information via a physical attack . The CVSS 3.1 score is 4.6 (MEDIUM) with a vector of AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, reflecting high confidentiality impact but no integrity or ...

EUVD-2026-73138

Heap-based buffer overflow in Windows RNDIS allows an unauthorized attacker to disclose information with a physical attack...

Windows RNDIS Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows RNDIS allows an unauthorized attacker to execute code over a network...

PT-2026-85655

In the Linux kernel, the following vulnerability has been resolved: rndis host: add overflow check in rndis rx fixup Add an overflow check to ensure that data offset + data len + 8 does not wrap, which would enable an OOB read of the USB data buffer...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: usb: rndishost: The secure rdrisquery check prevents integer overflow. The variables off and len, which are typed as uint32 in the rdrisquery function, are controlled by the incoming RNDIS response message. Therefore, their value...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In rndisqueryoid in drivers/net/wireless/rndiswlan.c within the Linux kernel, from version 6.1.5 onwards, there is an integer overflow in a mathematical operation...

Linux Distros Unpatched Vulnerability : CVE-2026-68088

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: gadget: function: rndis: add length check to response query Add variable representations for BufLength and BufOffset in rndisqueryresponse, and perform a...

SUSE CVE-2026-68088

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check to response query Add variable representations for BufLength and BufOffset in rndisqueryresponse, and perform a length check on them. This is identical to how rndissetresponse handle...

CVE-2026-68088

A flaw was found in the Linux kernel's RNDIS Remote Network Driver Interface Specification gadget function. A missing length check for BufLength and BufOffset parameters within the rndisqueryresponse function could allow a malicious actor to provide specially crafted input. This could lead to...