CVE-2024-11857

Executive Summary

CVE-2024-11857 is a high-severity (CVSS 7.8) local privilege escalation vulnerability in Realtek Bluetooth HCI Adapter drivers. The flaw is a Link Following vulnerability (CWE-59) that allows an attacker with local, low-privileged access to create a symbolic link with the same name as a specific file used by the driver. When the driver performs a file deletion operation, it follows the symbolic link and deletes the target file instead. This arbitrary file deletion capability can be leveraged by an attacker to delete critical system files (e.g., security descriptors, authentication binaries) and subsequently escalate privileges to SYSTEM or root.

The vulnerability is currently unpatched, and no public exploit code or proof-of-concept is available. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the technical impact is severe for any system using Realtek Bluetooth hardware.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a hardware driver vulnerability affecting Realtek Bluetooth chipsets and their associated Windows/Linux kernel drivers.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.8 (High)
• Attack Vector: Local (AV:L) – The attacker must have local access to the system.
• Attack Complexity: Low (AC:L) – No special conditions are required beyond standard file system access.
• Privileges Required: Low (PR:L) – The attacker needs only standard user privileges.
• User Interaction: None (UI:N) – No user action is required for exploitation.
• Scope: Unchanged (S:U) – The vulnerability does not cross trust boundaries.
• Confidentiality Impact: High (C:H) – Arbitrary file deletion can lead to data loss or exposure.
• Integrity Impact: High (I:H) – System files can be deleted, compromising system integrity.
• Availability Impact: High (A:H) – Deletion of critical files can cause system crashes or denial of service.

Threat Level: High. While no public exploit exists, the low complexity and high impact make this a prime target for privilege escalation chains.

Deep Dive & Mechanics

The vulnerability resides in the Realtek Bluetooth HCI (Host Controller Interface) driver, which manages communication between the operating system and the Bluetooth hardware. The driver performs file operations (likely temporary file creation/deletion) in a world-writable directory (e.g., C:\Windows\Temp or /tmp). The driver does not validate whether the file path it intends to delete is a symbolic link.

Attack Flow:

1. An attacker with low privileges identifies the exact file path that the Realtek driver will delete during normal operation (e.g., a temporary log file or configuration file).
2. The attacker creates a symbolic link (symlink) at that path, pointing to a critical system file (e.g., C:\Windows\System32\config\SAM or /etc/shadow).
3. When the driver performs the file deletion, it follows the symlink and deletes the target file.
4. The attacker then exploits the missing file to escalate privileges (e.g., by replacing the deleted file with a malicious version or by causing a service to fail and run with elevated privileges).

Root Cause: The driver uses a file deletion API (e.g., DeleteFile on Windows or unlink on Linux) without first checking if the path is a symbolic link. This is a classic CWE-59 (Improper Link Resolution Before File Access) vulnerability.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable pattern.

Vulnerable Code (Conceptual):

// Vulnerable: No symlink check before deletion
void delete_temp_file(const char *path) {
    // Directly deletes whatever path points to
    if (unlink(path) != 0) {
        // Error handling
    }
}

Patched Code (Conceptual):

// Patched: Check for symlink before deletion
#include <unistd.h>
#include <sys/stat.h>

void delete_temp_file(const char *path) {
    struct stat st;
    // Check if path is a symbolic link
    if (lstat(path, &st) == 0 && S_ISLNK(st.st_mode)) {
        // Log warning and abort deletion
        return;
    }
    // Safe to delete
    if (unlink(path) != 0) {
        // Error handling
    }
}

The patched version uses lstat() (which does not follow symlinks) to check the file type before deletion. If the path is a symlink, the operation is aborted.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local access to a system with Realtek Bluetooth hardware and the vulnerable driver installed.
• Low-privileged user account (e.g., user on Linux or Standard User on Windows).

Exploitation Steps (Conceptual):

1. Identify the target file path. Monitor the driver's behavior using Process Monitor (Windows) or strace (Linux) to find the exact path the driver deletes.
2. Create a symbolic link. Replace the target file with a symlink pointing to a critical system file.
   • On Linux: ln -s /etc/shadow /tmp/realtek_temp.log
   • On Windows: mklink C:\Windows\Temp\realtek_temp.log C:\Windows\System32\config\SAM
3. Trigger the driver operation. Perform a Bluetooth action (e.g., scan for devices) that causes the driver to delete the file.
4. Escalate privileges. After the critical file is deleted, exploit the resulting system state (e.g., by replacing the deleted file with a malicious version or by causing a service to fail and run with elevated privileges).

Example Script (Linux):

#!/bin/bash
# Exploit script for CVE-2024-11857 (Conceptual)
TARGET_FILE="/tmp/realtek_bt_temp.log"
SYMLINK_TARGET="/etc/shadow"

# Create symlink
ln -sf $SYMLINK_TARGET $TARGET_FILE

# Trigger driver deletion (e.g., by restarting Bluetooth service)
systemctl restart bluetooth

# Now /etc/shadow is deleted. System may be in a broken state.
# Further privilege escalation steps depend on the environment.

Blue Team (Detection & Defense)

Detection:

• Monitor for unexpected symlink creation in world-writable directories (e.g., /tmp, C:\Windows\Temp).
• Alert on file deletion operations targeting critical system files (e.g., /etc/shadow, SAM, LSASS).
• Use file integrity monitoring (FIM) to detect changes to critical files.

Defense:

• Apply the principle of least privilege to Bluetooth driver operations.
• Use mandatory access controls (e.g., SELinux, AppArmor) to restrict symlink creation.
• Implement kernel-level protections like protected_symlinks (Linux) or symlink evaluation restrictions (Windows).

Indicators of Compromise (IOCs)

• File System Events:
  • Creation of symbolic links in /tmp or C:\Windows\Temp pointing to system files.
  • Deletion of critical system files (e.g., /etc/shadow, SAM, LSASS).
• Process Activity:
  • Unusual Bluetooth driver processes (e.g., btusb, RealtekBtService.exe) performing file deletions.
• Log Entries:
  • Windows Event ID 4663 (An attempt was made to access an object) with Delete access on critical files.
  • Linux audit logs showing unlink syscalls on protected files.

Detection Engineering

YARA Rule

rule CVE_2024_11857_Symlink_Exploit {
    meta:
        description = "Detects symbolic link creation targeting critical system files for CVE-2024-11857"
        author = "Valters IT"
        date = "2025-04-10"
        severity = "high"
    strings:
        $symlink_cmd = "ln -s" nocase
        $target_shadow = "/etc/shadow" nocase
        $target_sam = "SAM" nocase
        $target_lsass = "lsass" nocase
    condition:
        any of ($symlink_cmd) and any of ($target_shadow, $target_sam, $target_lsass)
}

Sigma Rule

title: CVE-2024-11857 - Realtek Bluetooth Driver Symlink Exploit
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects creation of symbolic links to critical system files in world-writable directories
author: Valters IT
date: 2025-04-10
logsource:
    category: file_event
    product: windows
detection:
    selection:
        EventID: 4663
        ObjectName|contains:
            - 'C:\Windows\Temp'
            - '/tmp'
        AccessMask: '0x6'  # DELETE
        ProcessName|contains: 'Realtek'
    condition: selection
falsepositives:
    - Legitimate administrative actions
level: high

Suricata Rule

alert file any any -> any any (msg:"CVE-2024-11857 - Realtek Bluetooth Symlink Exploit"; file.name:"/etc/shadow" or file.name:"SAM"; file.operation:"delete"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Bluetooth if not required, or remove the Realtek Bluetooth driver.
2. Apply file system protections: On Linux, enable protected_symlinks via sysctl: sysctl -w fs.protected_symlinks=1. On Windows, use Group Policy to restrict symlink creation to administrators.
3. Monitor for exploitation: Deploy the YARA/Sigma rules above to detect attacks.

Long-Term Fix:

• Await an official patch from Realtek. Contact Realtek support for an ETA.
• If the driver is open-source, apply the patched code pattern described in the "Vulnerable vs. Patched Code" section.

Workaround:

• Use a different Bluetooth adapter from a vendor that properly validates file paths.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert