Vulnerability Details : CVE-2020-15137
All versions of HoRNDIS are affected by an integer overflow in the RNDIS packet parsing routines. A malicious USB device can trigger disclosure of unrelated kernel memory to userspace applications on the host, or can cause the kernel to crash. Kernel memory disclosure is especially likely on 32-bit kernels; 64-bit kernels are more likely to crash on attempted exploitation. It is not believed that kernel memory corruption is possible, or that unattended kernel memory disclosure without the collaboration of a userspace program running on the host is possible. The vulnerability is in `HoRNDIS::receivePacket`. `msg_len`, `data_ofs`, and `data_len` can be controlled by an attached USB device, and a negative value of `data_ofs` can bypass the check for `(data_ofs + data_len + 8) > msg_len`, and subsequently can cause a wild pointer copy in the `mbuf_copyback` call. The software is not maintained and no patches are planned. Users of multi-tenant systems with HoRNDIS installed should only connect trusted USB devices to their system.
Vulnerability category: OverflowMemory Corruption
Products affected by CVE-2020-15137
- cpe:2.3:a:horndis_project:horndis:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-15137
0.05%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 14 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-15137
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
3.6
|
LOW | AV:L/AC:L/Au:N/C:P/I:N/A:P |
3.9
|
4.9
|
NIST | |
|
5.9
|
MEDIUM | CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
0.7
|
5.2
|
NIST | |
|
5.5
|
MEDIUM | CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:H |
0.3
|
5.2
|
GitHub, Inc. |
CWE ids for CVE-2020-15137
-
The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.Assigned by:
- nvd@nist.gov (Primary)
- security-advisories@github.com (Secondary)
References for CVE-2020-15137
-
https://github.com/jwise/HoRNDIS/security/advisories/GHSA-8q4r-m3rh-57jx
Integer overflow in RNDIS packet parsing can result in kernel memory disclosure or denial of service from malicious USB device · Advisory · jwise/HoRNDIS · GitHubThird Party Advisory
Jump to