Privilege Escalation Vulnerability in Realtek RtsUpx USB Utility Driver
CVE-2021-36924

7.8HIGH

Key Information:

Vendor

Realtek

Status
Rtsupx Usb Utility Driver
Vendor
CVE Published:
2 November 2021

What is CVE-2021-36924?

The RtsUpx.sys driver within the Realtek RtsUpx USB Utility Driver for Camera, Hub, and Audio devices exhibits a vulnerability that allows local low-privileged users to exploit a pool overflow. This occurs by sending specially crafted Device IO Control packets to the affected device, potentially leading to privilege escalation, denial of service, or arbitrary code execution. This critical flaw emphasizes the need for immediate patching to mitigate the risks associated with unauthorized access and unintentional service disruptions.

References

https://www.sentinelone.com/resources/category/report/
x_refsource_MISC
https://www.realtek.com/images/safe-report/Realtek_RtsUpx...
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.