RtsUpx.sys
Realtek RtsUpx.sys 1.13.0.0 is within the affected range through 1.14.0.0. CVE-2021-36925 permits unauthorized physical-memory read/write through crafted device requests. Related vulnerabilities affect USB device access (CVE-2021-36922), privileged IN/OUT instructions (CVE-2021-36923), and pool memory handling (CVE-2021-36924). Static inspection of this sample confirms caller-controlled physical-memory mapping and copying in the device-control handler.
Known samples 1
0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.
RtsUpx.sysSample 1 · HVCI unknown
- MD5
788697523de62efdd0cf1812531ce840- SHA1
7352db51e2a1599b0ad671f91465a8304d41d135- SHA256
6e29c49f9e97747c77e5929d026538b5e7e2d999fefe1dd502a6a422b7cb6485- Imphash
ab986ade8b3cc340f30c1f64554034d7- Authentihash MD5
97de8956cfac9502d67da120e41aac5e- Authentihash SHA1
6ec3d3f71b940caafc3a2b0d4d9bd06c5e4b1fcd- Authentihash SHA256
777e171b7421454f7208762e4d7e9f7ffc251b176c087a0caf22f1ca3e31383d- Machine
- AMD64
- Version
- 1.13.0.0
- Publisher
- Realtek Semiconductor Corp.
Recorded command
sc.exe create RtsUpx binPath= C:\windows\temp\RtsUpx.sys type= kernel && sc.exe start RtsUpxAllows local low-privileged users to achieve an arbitrary read or write operation from/to physical memory. · Privileges: Unprivileged user with access to the loaded driver device; administrator rights to load it. · OS: Windows
Research & references
Acknowledgement: Element2023H @Element2023H