PT-2022-7669 · Realtek · Realtek Rtsuer Driver

Published 2022-05-05 · Updated 2024-11-04 · CVE-2022-25478

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Realtek RtsPer driver for PCIe Card Reader versions prior to 10.0.22000.21355 Realtek RtsUer driver for USB Card Reader versions prior to 10.0.22000.31274

Description The issue is related to insufficient input validation in the Realtek SD card reader device drivers, specifically RtsPer.sys and RtsUer.sys. This allows an attacker to gain read and write access to the PCI configuration space of the device.

Recommendations For Realtek RtsPer driver for PCIe Card Reader versions prior to 10.0.22000.21355, update to version 10.0.22000.21355 or later. For Realtek RtsUer driver for USB Card Reader versions prior to 10.0.22000.31274, update to version 10.0.22000.31274 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2024-08886

CVE-2022-25478

Affected Products

Realtek Rtsuer Driver

References · 12

• https://realtek.com/images/safe-report/Realtek_RtsPer_RtsUer_Security_Advisory_Report.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-25478 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25478 · Security Note
• https://bdu.fstec.ru/vul/2024-08886 · Security Note
• https://github.com/zwclose/realteksd · Note
• https://twitter.com/IntCyberDigest/status/1853448372318863715 · Twitter Post
• https://gist.github.com/zwclose/feb16f1424779a61cb1d9f6d5681408a · Note
• https://securitylab.ru/news/553185.php · Note
• https://feedly.com/cve/CVE-2022-25478 · Note
• https://t.me/cvenotify/91599 · Telegram Post
• http://realtek.com · Note
• https://zwclose.github.io/2024/10/14/rtsper1.html · Note