CVE-2022-25478
📋 TL;DR
This vulnerability in Realtek card reader drivers allows attackers with local access to read and write to the PCI configuration space, potentially enabling privilege escalation or system compromise. It affects systems using Realtek RtsPer (PCIe) driver versions before 10.0.22000.21355 or RtsUer (USB) driver versions before 10.0.22000.31274. The vulnerability requires local access but could be combined with other exploits for broader impact.
💻 Affected Systems
- Realtek RtsPer.sys driver
- Realtek RtsUer.sys driver
📦 What is this software?
Rtsper by Realtek
Rtsuer by Realtek
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through privilege escalation leading to arbitrary code execution, data theft, or persistence mechanisms installation.
Likely Case
Local privilege escalation allowing attackers to gain SYSTEM/root privileges from a lower-privileged account.
If Mitigated
Limited impact if proper access controls prevent local user access or if vulnerable drivers are not present.
🎯 Exploit Status
Exploit requires local access but is relatively straightforward once access is obtained. Public proof-of-concept code exists.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: RtsPer.sys 10.0.22000.21355+, RtsUer.sys 10.0.22000.31274+
Vendor Advisory: https://www.realtek.com/images/safe-report/Realtek_RtsPer_RtsUer_Security_Advisory_Report.pdf
Restart Required: Yes
Instructions:
1. Check current driver version in Device Manager under 'System devices' > 'Realtek PCIE CardReader' or similar. 2. Download updated drivers from Realtek or system manufacturer. 3. Install updated drivers. 4. Restart system.
🔧 Temporary Workarounds
Disable vulnerable drivers
windowsDisable the Realtek card reader drivers if not needed
sc stop RtsPer
sc config RtsPer start= disabled
sc stop RtsUer
sc config RtsUer start= disabled
Remove driver files
windowsDelete vulnerable driver files from system
del C:\Windows\System32\drivers\RtsPer.sys
del C:\Windows\System32\drivers\RtsUer.sys
🧯 If You Can't Patch
- Restrict local user access to systems with vulnerable drivers
- Implement application whitelisting to prevent unauthorized driver manipulation
🔍 How to Verify
Check if Vulnerable:
Check driver version in Device Manager or using: powershell Get-WmiObject Win32_PnPSignedDriver | Where-Object {$_.DeviceName -like '*Realtek*CardReader*'} | Select-Object DeviceName, DriverVersionCheck Version:
powershell Get-WmiObject Win32_PnPSignedDriver | Where-Object {$_.DeviceName -like '*Realtek*CardReader*'} | Select-Object DeviceName, DriverVersionVerify Fix Applied:
Verify driver version is at or above patched versions: RtsPer.sys >= 10.0.22000.21355, RtsUer.sys >= 10.0.22000.31274📡 Detection & Monitoring
Log Indicators:
- Driver loading events for RtsPer.sys or RtsUer.sys
- Unauthorized access attempts to PCI configuration space
- Privilege escalation events
Network Indicators:
- No direct network indicators - local exploit
SIEM Query:
EventID=7045 AND (ServiceName='RtsPer' OR ServiceName='RtsUer') OR EventID=4697 AND ServiceName LIKE '%Realtek%CardReader%'🔗 References
- http://realtek.com
- https://gist.github.com/zwclose/feb16f1424779a61cb1d9f6d5681408a
- https://www.realtek.com/images/safe-report/Realtek_RtsPer_RtsUer_Security_Advisory_Report.pdf
- https://zwclose.github.io/2024/10/14/rtsper1.html
- http://realtek.com
- https://gist.github.com/zwclose/feb16f1424779a61cb1d9f6d5681408a
- https://www.realtek.com/images/safe-report/Realtek_RtsPer_RtsUer_Security_Advisory_Report.pdf
