In the Linux kernel, the following vulnerability has been resolved:
usb: rndishost: Secure rndisquery check against int overflow
Variables off and len typed as uint32 in rndisquery function are controlled by incoming RNDIS response message thus their value may be manipulated. Setting off to a unexpectetly large value will cause the sum with len and 8 to overflow and pass the implemented validation step. Consequently the response pointer will be referring to a location past the expected buffer boundaries allowing information leakage e.g. via RNDISOID8023PERMANENTADDRESS OID.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/54xxx/CVE-2023-54110.json",
"cna_assigner": "Linux"
}