CVE-2020-15137

All versions of HoRNDIS are affected by an integer overflow in the RNDIS packet parsing routines. A malicious USB device can trigger disclosure of unrelated kernel memory to userspace applications on the host, or can cause the kernel to crash. Kernel memory disclosure is especially likely on 32-bit kernels; 64-bit kernels are more likely to crash on attempted exploitation. It is not believed that kernel memory corruption is possible, or that unattended kernel memory disclosure without the collaboration of a userspace program running on the host is possible. The vulnerability is in `HoRNDIS::receivePacket`. `msg_len`, `data_ofs`, and `data_len` can be controlled by an attached USB device, and a negative value of `data_ofs` can bypass the check for `(data_ofs + data_len + 8) > msg_len`, and subsequently can cause a wild pointer copy in the `mbuf_copyback` call. The software is not maintained and no patches are planned. Users of multi-tenant systems with HoRNDIS installed should only connect trusted USB devices to their system.

• CWE-190
• CWE-190

• https://github.com/jwise/HoRNDIS/security/advisories/GHSA-8q4r-m3rh-57jxThird Party Advisory
• https://github.com/jwise/HoRNDIS/security/advisories/GHSA-8q4r-m3rh-57jxThird Party Advisory

Published

Aug 12, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15131In SLP Validate (npm package slp-validate) before version 1.…7.5
• CVE-2020-15132In Sulu before versions 1.6.35, 2.0.10, and 2.1.1, when the …5.3
• CVE-2020-15133In faye-websocket before version 0.11.0, there is a lack of …8.7
• CVE-2020-15134Faye before version 1.4.0, there is a lack of certification …8.7
• CVE-2020-15135save-server (npm package) before version 1.05 is affected by…7.6
• CVE-2020-15136In ectd before versions 3.4.10 and 3.3.23, gateway TLS authe…6.5
• CVE-2020-15138Prism is vulnerable to Cross-Site Scripting. The easing prev…7.5
• CVE-2020-15139In MyBB before version 1.8.24, the custom MyCode (BBCode) fo…6.1
• CVE-2020-1514<p>A cross-site-scripting (XSS) vulnerability exists when Mi…5.4
• CVE-2020-15140In Red Discord Bot before version 3.3.11, a RCE exploit has …9.6
• CVE-2020-15141In openapi-python-client before version 0.5.3, there is a pa…4.1
• CVE-2020-15142In openapi-python-client before version 0.5.3, clients gener…9