CVE-2024-33225

Vulnerability

Overview

CVE-2024-33225 is a vulnerability in Realtek Semiconductor Corp's High Definition Audio Function Driver (RTKVHD64.sys) version 6.0.9549.1. The driver exposes functionality to map physical memory and perform I/O port read/write operations through IOCTL requests without proper privilege checks, allowing low-privileged users to invoke these operations [1].

Exploitation

An attacker with low privileges on a system can exploit this vulnerability by sending crafted IOCTL requests to the driver via the DeviceIoControl API. The driver's IOCTL handler at offset 0x59C190 does not validate the caller's privileges, enabling arbitrary physical memory mapping and port I/O access [1].

Impact

Successful exploitation grants the attacker arbitrary code execution with high privileges, privilege escalation, and information disclosure. Additionally, because the driver is signed, it can be used to bypass Microsoft's driver-signing policy to deploy malicious code [1].

Mitigation

As of the advisory, no official patch has been released. Users are advised to restrict access to the vulnerable driver or disable it if possible. Realtek has not commented on a timeline for a fix [1].