CVE-2022-25480
📋 TL;DR
This vulnerability in Realtek card reader drivers allows attackers to write beyond allocated kernel memory buffers, potentially leading to privilege escalation or system crashes. It affects Windows systems using vulnerable Realtek PCIe or USB card reader drivers. Attackers with local access could exploit this to gain elevated privileges.
💻 Affected Systems
- Realtek RtsPer.sys driver for PCIe Card Reader
- Realtek RtsUer.sys driver for USB Card Reader
📦 What is this software?
Rtsper by Realtek
Rtsuer by Realtek
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation to SYSTEM/root, enabling complete system compromise, data theft, or installation of persistent malware.
Likely Case
Local privilege escalation allowing attackers to bypass security controls, install additional malware, or access sensitive data.
If Mitigated
Limited impact if proper access controls prevent local user execution or if vulnerable drivers are not present.
🎯 Exploit Status
Proof-of-concept code is publicly available. Exploitation requires local access but is relatively straightforward for attackers with user privileges.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: RtsPer.sys 10.0.22000.21355+, RtsUer.sys 10.0.22000.31274+
Vendor Advisory: https://www.realtek.com/images/safe-report/Realtek_RtsPer_RtsUer_Security_Advisory_Report.pdf
Restart Required: Yes
Instructions:
1. Check Windows Update for driver updates. 2. Install Realtek driver updates from manufacturer website. 3. Restart system. 4. Verify driver versions match patched versions.
🔧 Temporary Workarounds
Disable vulnerable drivers
windowsDisable the Realtek card reader drivers if not needed
sc stop RtsPer
sc stop RtsUer
sc config RtsPer start= disabled
sc config RtsUer start= disabled
🧯 If You Can't Patch
- Restrict local user access to systems with vulnerable drivers
- Implement application whitelisting to prevent unauthorized code execution
🔍 How to Verify
Check if Vulnerable:
Check driver versions in Device Manager under 'Storage controllers' for Realtek card readers, or run: driverquery | findstr RtsPer RtsUerCheck Version:
driverquery /v | findstr /i "RtsPer RtsUer"Verify Fix Applied:
Verify driver versions show 10.0.22000.21355+ for RtsPer.sys and 10.0.22000.31274+ for RtsUer.sys📡 Detection & Monitoring
Log Indicators:
- Driver loading events for RtsPer.sys or RtsUer.sys
- System crashes with driver-related errors
- Unusual privilege escalation attempts
Network Indicators:
- No direct network indicators - local exploitation only
SIEM Query:
EventID=7045 AND (ServiceName="RtsPer" OR ServiceName="RtsUer")🔗 References
- http://realtek.com
- https://gist.github.com/zwclose/feb16f1424779a61cb1d9f6d5681408a
- https://www.realtek.com/images/safe-report/Realtek_RtsPer_RtsUer_Security_Advisory_Report.pdf
- https://zwclose.github.io/2024/10/14/rtsper1.html
- http://realtek.com
- https://gist.github.com/zwclose/feb16f1424779a61cb1d9f6d5681408a
- https://www.realtek.com/images/safe-report/Realtek_RtsPer_RtsUer_Security_Advisory_Report.pdf
