CVE-2022-25477
📋 TL;DR
This vulnerability in Realtek card reader drivers leaks kernel memory addresses in driver logs, weakening Kernel Address Space Layout Randomization (KASLR). Attackers can use this information to bypass security mitigations and potentially execute more sophisticated attacks. Systems using vulnerable Realtek PCIe or USB card reader drivers are affected.
💻 Affected Systems
- Realtek RtsPer driver for PCIe Card Reader
- Realtek RtsUer driver for USB Card Reader
📦 What is this software?
Rtsper by Realtek
Rtsuer by Realtek
⚠️ Risk & Real-World Impact
Worst Case
Attackers combine this information leak with other vulnerabilities to bypass KASLR and execute kernel-level code, potentially gaining full system control.
Likely Case
Information disclosure that aids attackers in developing more reliable exploits against the system by bypassing KASLR protections.
If Mitigated
Limited information disclosure with minimal impact if proper security controls prevent attackers from accessing driver logs.
🎯 Exploit Status
Proof of concept demonstrates information leakage. Exploitation requires ability to read driver logs and additional vulnerabilities for full system compromise.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: RtsPer.sys 10.0.22000.21355+, RtsUer.sys 10.0.22000.31274+
Vendor Advisory: https://www.realtek.com/images/safe-report/Realtek_RtsPer_RtsUer_Security_Advisory_Report.pdf
Restart Required: Yes
Instructions:
1. Download updated drivers from Realtek website or Windows Update. 2. Install updated drivers. 3. Restart system to load patched drivers.
🔧 Temporary Workarounds
Restrict driver log access
windowsLimit access to driver log files to prevent unauthorized reading of leaked addresses
icacls C:\Windows\System32\LogFiles\* /deny Users:(R)
Disable vulnerable card readers
windowsTemporarily disable Realtek card readers in Device Manager if not needed
🧯 If You Can't Patch
- Implement strict access controls to prevent unauthorized users from reading system logs
- Monitor for suspicious attempts to access driver logs or kernel memory
🔍 How to Verify
Check if Vulnerable:
Check driver versions in Device Manager under 'System devices' for Realtek PCIe/USB Card Reader, or run: driverquery | findstr RtsPer RtsUerCheck Version:
driverquery /v | findstr /i "RtsPer RtsUer"Verify Fix Applied:
Verify driver versions show 10.0.22000.21355+ for RtsPer.sys or 10.0.22000.31274+ for RtsUer.sys📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to driver log files
- Attempts to read kernel memory addresses from logs
Network Indicators:
- No direct network indicators - local vulnerability
SIEM Query:
EventID=4663 AND ObjectName="*\LogFiles\*" AND AccessMask="0x1" | where SubjectUserName not in ("SYSTEM", "LOCAL SERVICE", "NETWORK SERVICE")🔗 References
- http://realtek.com
- https://gist.github.com/zwclose/feb16f1424779a61cb1d9f6d5681408a
- https://www.realtek.com/images/safe-report/Realtek_RtsPer_RtsUer_Security_Advisory_Report.pdf
- https://zwclose.github.io/2024/10/14/rtsper1.html
- http://realtek.com
- https://gist.github.com/zwclose/feb16f1424779a61cb1d9f6d5681408a
- https://www.realtek.com/images/safe-report/Realtek_RtsPer_RtsUer_Security_Advisory_Report.pdf
