Recent revelations have unveiled critical security flaws in Realtek’s SD card reader driver, RtsPer.sys, which affect numerous laptops from major manufacturers such as Dell, Lenovo, HP, and MSI. These vulnerabilities, some of which have remained undisclosed for years, pose serious risks to users by potentially allowing attackers to leak kernel memory, write to arbitrary kernel addresses, and access physical memory from user mode. Such breaches could lead to privilege escalation and overall system compromise, raising significant concerns about the safety of utilizing these drivers in everyday computing.
Security researchers uncovered multiple CVEs linked to these flaws, including CVE-2022-25477, which involves leaking driver logs, and CVE-2022-25478, which allows accessing PCI configuration space. Additionally, CVE-2022-25479 involves leaking kernel pool and stack, while CVE-2022-25480 and CVE-2024-40432 pose risks by writing beyond IRP::SystemBuffer. The most critical combination identified is CVE-2024-40431 and CVE-2022-25479, which allow arbitrary writing to kernel memory. This poses a severe threat to the security of Windows systems by potentially disabling driver signature enforcement, thereby enabling various forms of exploitation.
Impact on Various Laptop Models
The vulnerabilities impact several SD card reader models such as RTS5227, RTS5228, RTS522A, RTS5249, RTS524A, among others. Despite multiple attempts to rectify these issues, some vulnerabilities have remained, pointing to underlying weaknesses in how the driver handles SCSI commands, input validation, and memory operation checks. Realtek has responded by releasing patches, with the latest fixed version being RtsPer.sys 10.0.26100.21374 or higher. However, users of affected laptops are strongly advised to update their drivers promptly to mitigate these security risks.
A significant concern is that many users might still be vulnerable if OEMs do not distribute the updates through standard channels. This scenario underscores the necessity for rigorous security audits of widely-used drivers. Failures in driver security like these can have extensive and severe consequences, affecting a broad array of devices and endangering user data and system integrity. The persistent nature of these vulnerabilities highlights the complicated and often delayed process of identifying and resolving deep-seated software flaws embedded within hardware drivers.
Lagging Response from Manufacturers
Critical security weaknesses have been found in Realtek’s SD card reader driver, RtsPer.sys, impacting a wide range of laptops from leading brands like Dell, Lenovo, HP, and MSI. These vulnerabilities, some undiscovered for years, present grave dangers to users by potentially enabling attackers to leak kernel memory, write to arbitrary kernel addresses, and access physical memory from user mode. Such security breaches can result in privilege escalation and total system compromise, putting into question the safety of these drivers in daily computing.
Researchers have identified several CVEs connected to these flaws. CVE-2022-25477 leaks driver logs, while CVE-2022-25478 allows access to the PCI configuration space. CVE-2022-25479 involves leaking the kernel pool and stack. CVE-2022-25480 and CVE-2024-40432 create risks by writing beyond IRP::SystemBuffer. The most alarming combination, CVE-2024-40431 and CVE-2022-25479, allows arbitrary writing to kernel memory. This poses a severe threat to Windows system security by potentially disabling driver signature enforcement, opening the door to exploitation of various kinds.