Local Privilege Escalation in Realtek USB Utility Driver
CVE-2021-36925

7.8HIGH

Key Information:

Vendor

Realtek

Status
Rtsupx Usb Utility Driver
Vendor
CVE Published:
2 November 2021

What is CVE-2021-36925?

The RtsUpx USB Utility Driver provided by Realtek contains a vulnerability that allows low-privileged local users to perform arbitrary read and write operations to physical memory. By sending a specially crafted Device IO Control packet to the device, an attacker can potentially escalate privileges, execute arbitrary code, lead to denial of service, or disclose sensitive information. Users are advised to apply available patches and follow security guidelines to protect against exploitation.

References

https://www.sentinelone.com/resources/category/report/
x_refsource_MISC
https://www.realtek.com/images/safe-report/Realtek_RtsUpx...
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.