PT-2022-7667 · Realtek · Realtek Rtsuer Driver For Usb Card Reader+1

Published 2022-05-05 · Updated 2024-11-04 · CVE-2022-25480

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Realtek RtsPer driver for PCIe Card Reader versions prior to 10.0.22000.21355 Realtek RtsUer driver for USB Card Reader versions prior to 10.0.22000.31274

Description The issue is related to a buffer overflow in memory, allowing an attacker to write data to kernel memory beyond the system buffer of the IRP. This can be exploited by writing to kernel memory beyond the SystemBuffer of the IRP.

Recommendations For Realtek RtsPer driver for PCIe Card Reader versions prior to 10.0.22000.21355, update to version 10.0.22000.21355 or later. For Realtek RtsUer driver for USB Card Reader versions prior to 10.0.22000.31274, update to version 10.0.22000.31274 or later.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2024-08884

CVE-2022-25480

Affected Products

Realtek Rtsper Driver For Pcie Card Reader

Realtek Rtsuer Driver For Usb Card Reader

References · 13

• https://realtek.com/images/safe-report/Realtek_RtsPer_RtsUer_Security_Advisory_Report.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25480 · Security Note
• https://osv.dev/vulnerability/CVE-2022-25480 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-08884 · Security Note
• https://github.com/zwclose/realteksd · Note
• https://twitter.com/IntCyberDigest/status/1853448372318863715 · Twitter Post
• http://realtek.com · Note
• https://t.me/cvenotify/91562 · Telegram Post
• https://feedly.com/cve/CVE-2022-25480 · Note
• https://t.me/cvenotify/91571 · Telegram Post
• https://gist.github.com/zwclose/feb16f1424779a61cb1d9f6d5681408a · Note
• https://securitylab.ru/news/553185.php · Note
• https://zwclose.github.io/2024/10/14/rtsper1.html · Note