The usual card reader in the laptop was able to interfere with the work of RAM bypassing Windows and protective equipment. The ZwClose specialist showed how the vulnerability in the Realtek driver allows an unprivileged program to access the physical memory of the computer through the mechanism of direct access to memory.
The problem affects the drivers of Realtek cartels for Windows. The first vulnerability was discovered by the specialist in January 2022. The manufacturer issued corrections, but later it turned out that one of the most dangerous opportunities survived. The driver still allowed programs without increased rights to control the registers of the device and through them to access the direct access controller to the memory.
Such a mechanism allows devices to exchange data with RAM without the participation of the central processor. At the level of physical memory, there are no habitual boundaries between processes, the system kernel and user programs. Moreover, such operations are imperceptible for Windows and means of detecting attacks.
To prove that the error is dangerous, the specialist created a working example of an attack. The program from the user mode manages the cartridge, forms commands for the controller and records data from the memory card to an arbitrary physical address. Due to 32-bit address rate, the device access is limited to the first 4 GB of physical memory, but this is enough to interfere in the work of other processes.
It took several months to set up a working example. Realtek does not publish detailed documentation for the device, so the specialist studied the driver code and open drivers for other operating systems. One of the main difficulties was to find a way to transfer the address to the controller of the desired memory area. The solution was the own buffer of the cartridge commands, the physical address of which can be obtained through a vulnerable driver.
In the demonstration, the program recorded the contents of the memory card sector directly into the physical pages that belonged to another process. The attack showed that an unprivileged application can change someone else’s memory without regular appeals to the operating system.
Realtek needed several attempts to completely eliminate the problem. The first corrections were insufficient, and the final update was released in August 2024. The manufacturer has removed the control commands that allow programs to access the device registers and transfer your own commands, and the new versions of the drivers also include reassigning direct access to memory.
Dell and Lenovo after a separate notification updated the packages of drivers for affected laptop models. The problem may apply to devices and other manufacturers. The specialist recommends checking versions of RtsPer.sys and RtsUer.sys files and installing fresh drivers through the Windows update directory if outdated versions are used.
The problem affects the drivers of Realtek cartels for Windows. The first vulnerability was discovered by the specialist in January 2022. The manufacturer issued corrections, but later it turned out that one of the most dangerous opportunities survived. The driver still allowed programs without increased rights to control the registers of the device and through them to access the direct access controller to the memory.
Such a mechanism allows devices to exchange data with RAM without the participation of the central processor. At the level of physical memory, there are no habitual boundaries between processes, the system kernel and user programs. Moreover, such operations are imperceptible for Windows and means of detecting attacks.
To prove that the error is dangerous, the specialist created a working example of an attack. The program from the user mode manages the cartridge, forms commands for the controller and records data from the memory card to an arbitrary physical address. Due to 32-bit address rate, the device access is limited to the first 4 GB of physical memory, but this is enough to interfere in the work of other processes.
It took several months to set up a working example. Realtek does not publish detailed documentation for the device, so the specialist studied the driver code and open drivers for other operating systems. One of the main difficulties was to find a way to transfer the address to the controller of the desired memory area. The solution was the own buffer of the cartridge commands, the physical address of which can be obtained through a vulnerable driver.
In the demonstration, the program recorded the contents of the memory card sector directly into the physical pages that belonged to another process. The attack showed that an unprivileged application can change someone else’s memory without regular appeals to the operating system.
Realtek needed several attempts to completely eliminate the problem. The first corrections were insufficient, and the final update was released in August 2024. The manufacturer has removed the control commands that allow programs to access the device registers and transfer your own commands, and the new versions of the drivers also include reassigning direct access to memory.
Dell and Lenovo after a separate notification updated the packages of drivers for affected laptop models. The problem may apply to devices and other manufacturers. The specialist recommends checking versions of RtsPer.sys and RtsUer.sys files and installing fresh drivers through the Windows update directory if outdated versions are used.
