CVE-2025-14614

Executive Summary

CVE-2025-14614 describes an insecure temporary file vulnerability in the Altera Quartus Prime Standard and Lite Installer (SFX) on Windows. The vulnerability allows an attacker to perform a "Explore for Predictable Temporary File Names" attack, which can lead to privilege escalation or arbitrary file manipulation. The affected versions are Quartus Prime Standard and Lite from 23.1 through 24.1. As of this report, no official patch has been released, and no public proof-of-concept (PoC) or exploit code is available.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a proprietary Windows installer (SFX) for Altera Quartus Prime, a hardware design tool. The risk is primarily to end-user systems where the installer is executed, potentially allowing a local attacker to hijack temporary files and escalate privileges.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official CVSS vector assigned)
• EPSS Score: 0.0% (Very low exploitation probability)
• Threat Level: Medium (Local privilege escalation via insecure temp file handling)
• Attack Vector: Local (requires user to run the installer)
• Impact: Confidentiality, Integrity, Availability (partial)

Deep Dive & Mechanics

The vulnerability lies in the Altera Quartus Prime Installer (SFX) for Windows. The installer creates temporary files with predictable names during the extraction and installation process. An attacker with local access can monitor the file system for these predictable temporary file names and create symbolic links or hard links to critical system files. When the installer writes to the temporary file, it can overwrite the target file, leading to privilege escalation or arbitrary file write.

The core issue is the use of a predictable naming scheme for temporary files without proper access control or randomization. This is a classic CWE-377 (Insecure Temporary File) vulnerability.

Vulnerable vs. Patched Code

No patched code is available. The vulnerable code is within the SFX installer binary, which is not open source. The expected fix would involve:

• Using GetTempFileName with a random prefix or using CreateFile with FILE_FLAG_DELETE_ON_CLOSE.
• Setting proper DACL (Discretionary Access Control List) on the temporary file to prevent other users from accessing it.
• Using a secure temporary directory (e.g., user-specific temp folder).

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a Windows system where the Altera Quartus Prime Installer (version 23.1-24.1) is being executed.
• Ability to run code as a low-privileged user.

Exploitation Steps:

1. Monitor the file system for the creation of temporary files by the installer (e.g., using ReadDirectoryChangesW or polling).
2. Identify the predictable temporary file name pattern (e.g., Altera_Quartus_*.tmp).
3. Before the installer writes to the temporary file, create a symbolic link from the temporary file path to a target file (e.g., C:\Windows\System32\config\SAM or a DLL in the installer's directory).
4. When the installer writes to the temporary file, it will overwrite the target file, potentially leading to privilege escalation or arbitrary code execution.

Example PowerShell script (conceptual):

# Monitor for temp file creation
$watcher = New-Object System.IO.FileSystemWatcher
$watcher.Path = $env:TEMP
$watcher.Filter = "Altera_Quartus_*.tmp"
$watcher.EnableRaisingEvents = $true

Register-ObjectEvent $watcher "Created" -Action {
    $tempFile = $Event.SourceEventArgs.FullPath
    # Create symlink to target
    New-Item -ItemType SymbolicLink -Path $tempFile -Target "C:\Windows\System32\drivers\etc\hosts"
}

Blue Team

Detection:

• Monitor for creation of symbolic links in the %TEMP% directory.
• Monitor for file creation events with predictable names (e.g., Altera_Quartus_*.tmp).
• Use Sysmon Event ID 11 (FileCreate) and Event ID 13 (RegistryEvent) to detect suspicious file operations.

Mitigation:

• Run the installer with the least privilege necessary.
• Use AppLocker or Windows Defender Application Control to block untrusted installers.
• Apply the principle of least privilege to user accounts.

Indicators of Compromise (IOCs)

• File Paths:
  • %TEMP%\Altera_Quartus_*.tmp
  • %TEMP%\Altera_Quartus_*.tmp.lnk (symbolic link)
• Registry Keys:
  • HKCU\Software\Altera\Quartus\* (installer state)
• Process Names:
  • QuartusSetup.exe (or similar installer executable)
• Network Connections:
  • None (local vulnerability)

Detection Engineering

YARA Rule

rule CVE_2025_14614_Insecure_Temp_File {
    meta:
        description = "Detects predictable temporary file names used by Altera Quartus Prime Installer"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-14614"
    strings:
        $temp_pattern = /Altera_Quartus_[a-zA-Z0-9]{4}\.tmp/ nocase
    condition:
        $temp_pattern
}

Sigma Rule

title: Altera Quartus Prime Installer Predictable Temp File
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects creation of predictable temporary files by Altera Quartus Prime Installer
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-14614
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|contains: 'Altera_Quartus_'
        TargetFilename|endswith: '.tmp'
    condition: selection
falsepositives:
    - Legitimate Altera Quartus Prime installation
level: medium

Suricata Rule

alert file any any -> any any (msg:"CVE-2025-14614 - Altera Quartus Prime Predictable Temp File"; file.name:"Altera_Quartus_*.tmp"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Do not run the installer as Administrator unless absolutely necessary.
2. Run the installer in a sandboxed environment (e.g., Windows Sandbox, VM) to isolate the risk.
3. Monitor for suspicious file operations in the %TEMP% directory during installation.

Long-term Fix:

• Await an official patch from Altera (Intel) that addresses the insecure temporary file handling.
• Consider using an alternative installation method (e.g., silent install with predefined temp directory).

Workaround:

• Set the TMP and TEMP environment variables to a directory with strict permissions (e.g., C:\SecureTemp) before running the installer.

Valters IT