CVE-2025-14612

Executive Summary

CVE-2025-14612 is a high-severity Insecure Temporary File vulnerability in the Altera Quartus Prime Pro Installer (SFX) on Windows. The vulnerability allows an attacker to exploit predictable file names during the installation process, potentially leading to privilege escalation, arbitrary file write, or denial of service. The affected versions range from 24.1 through 25.1.1. No official patch has been released, and no public exploit code or proof-of-concept is currently available. The vulnerability is classified under CWE-377 (Insecure Temporary File) and is associated with MITRE ATT&CK technique T1574.002 (Hijack Execution Flow: DLL Side-Loading) due to the potential for file manipulation during installation.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a Windows-native installer vulnerability specific to Altera Quartus Prime Pro.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or uncalculated value. Based on the vulnerability description and CWE-377 classification, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Local (L) – requires local access to the system.
• Attack Complexity (AC): Low (L) – predictable file names are easy to exploit.
• Privileges Required (PR): Low (L) – attacker needs user-level access.
• User Interaction (UI): None (N) – no user action required beyond installation.
• Scope (S): Unchanged (U) – exploitation does not cross trust boundaries.
• Confidentiality (C): High (H) – potential to read sensitive files.
• Integrity (I): High (H) – potential to write malicious files.
• Availability (A): High (H) – potential to cause denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Estimated Score: 7.8 (High)

Threat Level: High. The vulnerability is easy to exploit locally, requires low privileges, and can lead to full system compromise.

Deep Dive & Mechanics

The vulnerability resides in the Altera Quartus Prime Pro Installer (SFX) on Windows. The installer creates temporary files during the extraction and installation process. Due to the use of predictable file names, an attacker with local access can pre-create or modify these temporary files before the installer uses them. This can lead to:

• Privilege Escalation: If the installer runs with elevated privileges, the attacker can inject malicious code into the temporary files, which will then be executed with higher privileges.
• Arbitrary File Write: The attacker can overwrite system files or configuration files by manipulating the temporary file paths.
• Denial of Service: By creating a large number of temporary files or locking them, the attacker can cause the installer to fail.

The vulnerability is classified under CWE-377 (Insecure Temporary File), which describes the use of temporary files with predictable names in an insecure manner. The attack vector is local, requiring the attacker to have user-level access to the system.

Vulnerable vs. Patched Code

Since no patch is available, a direct code comparison is not possible. However, the vulnerable behavior can be described as:

Vulnerable Code (Conceptual):

// Predictable temporary file name
char temp_path[MAX_PATH];
GetTempPathA(MAX_PATH, temp_path);
sprintf(temp_path, "%s\\quartus_temp_%d.tmp", temp_path, 12345);
HANDLE hFile = CreateFileA(temp_path, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
// Write data to the file
// ...
CloseHandle(hFile);

Patched Code (Conceptual):

// Use a secure random file name
char temp_path[MAX_PATH];
GetTempPathA(MAX_PATH, temp_path);
char temp_file[MAX_PATH];
if (GetTempFileNameA(temp_path, "QRT", 0, temp_file) == 0) {
    // Handle error
}
HANDLE hFile = CreateFileA(temp_file, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
// Write data to the file
// ...
CloseHandle(hFile);

The patched version uses GetTempFileNameA to generate a unique, non-predictable file name, mitigating the race condition.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local user access to a Windows system running Altera Quartus Prime Pro Installer (versions 24.1 through 25.1.1).
• Knowledge of the predictable temporary file name pattern.

Exploitation Steps:

1. Identify the predictable temporary file name pattern used by the installer (e.g., C:\Users\<username>\AppData\Local\Temp\quartus_temp_*.tmp).
2. Create a malicious script or executable that will be placed in the temporary file path.
3. Use a file system watcher or a race condition to replace the legitimate temporary file with the malicious one before the installer uses it.
4. The installer executes the malicious file with its privileges, leading to code execution.

Example Script (PowerShell):

# Monitor for the creation of the predictable temporary file
$watcher = New-Object System.IO.FileSystemWatcher
$watcher.Path = "C:\Users\$env:USERNAME\AppData\Local\Temp"
$watcher.Filter = "quartus_temp_*.tmp"
$watcher.EnableRaisingEvents = $true

Register-ObjectEvent $watcher "Created" -Action {
    # Replace the file with a malicious one
    $maliciousContent = "malicious code here"
    Set-Content -Path $Event.SourceEventArgs.FullPath -Value $maliciousContent
}

Blue Team (Detection & Defense)

Detection:

• Monitor for file creation events in temporary directories with predictable names.
• Use Sysmon to log file creation events (Event ID 11) and look for patterns like quartus_temp_*.tmp.
• Enable Windows Defender ATP or similar EDR to detect file manipulation attempts.

Defense:

• Apply the principle of least privilege to the installer process.
• Use AppLocker or Windows Defender Application Control to restrict execution of untrusted binaries.
• Implement file system auditing to detect unauthorized file modifications.

Indicators of Compromise (IOCs)

• File Paths:
  • C:\Users\<username>\AppData\Local\Temp\quartus_temp_*.tmp
  • C:\Windows\Temp\quartus_temp_*.tmp
• Process Names:
  • QuartusPrimeProInstaller.exe
  • SFX.exe (self-extracting archive)
• Registry Keys:
  • HKEY_CURRENT_USER\Software\Altera\Quartus Prime Pro
• Network Connections:
  • Outbound connections to Altera update servers (if any)

Detection Engineering

YARA Rule

rule CVE_2025_14612_Insecure_Temp_File {
    meta:
        description = "Detects predictable temporary file names used by Altera Quartus Prime Pro Installer"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-14612"
    strings:
        $temp_pattern = "quartus_temp_" ascii wide nocase
    condition:
        $temp_pattern
}

Sigma Rule

title: CVE-2025-14612 - Insecure Temporary File in Altera Quartus Prime Pro Installer
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects creation of predictable temporary files by Altera Quartus Prime Pro Installer
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-14612
logsource:
    product: windows
    service: sysmon
    category: file_event
detection:
    selection:
        EventID: 11
        TargetFilename|contains: 'quartus_temp_'
    condition: selection
falsepositives:
    - Legitimate Altera Quartus Prime Pro installation
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-14612 - Altera Quartus Prime Pro Installer Insecure Temp File"; flow:to_server,established; content:"quartus_temp_"; nocase; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the installer if not required, or use a sandboxed environment for installation.
2. Apply file system permissions to restrict write access to temporary directories for non-administrative users.
3. Monitor for suspicious file creation in temporary directories using the provided detection rules.

Long-Term Fix:

• Await an official patch from Altera. In the meantime, consider using alternative FPGA development tools that do not have this vulnerability.
• Implement a custom installer wrapper that uses secure temporary file generation (e.g., GetTempFileNameA with a random prefix).

Workaround:

• Run the installer in a virtual machine or isolated environment to limit the impact of exploitation.

Valters IT