PT-2022-7668 · Realtek · Realtek Rtsuer Driver For Usb Card Reader+1

Published 2022-05-05 · Updated 2024-11-05 · CVE-2022-25479

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Name of the Vulnerable Software and Affected Versions Realtek RtsPer driver for PCIe Card Reader versions prior to 10.0.22000.21355 Realtek RtsUer driver for USB Card Reader versions prior to 10.0.22000.31274

Description The issue is related to memory release errors in the Realtek SD card reader device firmware. Exploitation of this issue may allow an attacker to access kernel memory from both the stack and the heap.

Recommendations For Realtek RtsPer driver for PCIe Card Reader versions prior to 10.0.22000.21355, update to version 10.0.22000.21355 or later. For Realtek RtsUer driver for USB Card Reader versions prior to 10.0.22000.31274, update to version 10.0.22000.31274 or later.

Exploit

Fix

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

BDU:2024-08885

CVE-2022-25479

Affected Products

Realtek Rtsper Driver For Pcie Card Reader

Realtek Rtsuer Driver For Usb Card Reader

References · 21

• 🔥 https://github.com/SpiralBL0CK/CVE-2024-40431-CVE-2022-25479-EOP-CHAIN · Exploit
• https://realtek.com/images/safe-report/Realtek_RtsPer_RtsUer_Security_Advisory_Report.pdf · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-08885 · Security Note
• https://osv.dev/vulnerability/CVE-2022-25479 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25479 · Security Note
• https://github.com/zwclose/realteksd · Note
• https://twitter.com/IntCyberDigest/status/1853448372318863715 · Twitter Post
• https://twitter.com/autumn_good_35/status/1853613144155079105 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1835943355496145120 · Twitter Post
• https://twitter.com/FAMASoon/status/1847284888355082553 · Twitter Post
• http://realtek.com · Note
• https://t.me/cvenotify/91600 · Telegram Post
• https://feedly.com/cve/CVE-2022-25479 · Note
• https://twitter.com/kmkz_security/status/1835932608905044272 · Twitter Post
• https://t.me/cvenotify/91561 · Telegram Post