CVE-2024-40431 Overview
CVE-2024-40431 is a driver vulnerability in the Realtek SD card reader driver before version 10.0.26100.21374. The flaw stems from missing input validation in the IOCTL_SCSI_PASS_THROUGH control handler. A low-privileged local user can issue crafted IOCTL requests that write to predictable kernel memory locations. Successful exploitation enables privilege escalation and full compromise of the affected Windows host.
Critical Impact
Low-privileged users can write to predictable kernel memory addresses, enabling local privilege escalation to SYSTEM on Windows systems running vulnerable Realtek SD card reader drivers.
Affected Products
- Realtek SD card reader driver versions prior to 10.0.26100.21374
- Windows systems shipping Realtek PCIe/USB SD card reader hardware
- OEM laptop and desktop platforms bundling the Realtek RtsPer.sys driver
Discovery Timeline
- 2024-10-23 - CVE-2024-40431 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-40431
Vulnerability Analysis
The Realtek SD card reader driver exposes an IOCTL interface that accepts IOCTL_SCSI_PASS_THROUGH requests from user mode. The driver fails to validate the fields inside the SCSI pass-through structure before acting on them. Specifically, the driver trusts caller-supplied pointers and length fields that describe data transfer buffers and response destinations.
Because the driver runs in kernel context, any unchecked write derived from those fields lands in kernel memory. An attacker can steer these writes to predictable addresses inside the kernel. This provides a primitive for corrupting kernel structures, disabling security callbacks, or overwriting tokens to elevate privileges.
Root Cause
The root cause is Improper Input Validation in a kernel driver IOCTL handler [CWE-20]. The driver processes attacker-controlled buffer descriptors from IOCTL_SCSI_PASS_THROUGH without verifying that destination addresses point to user-mode memory or fall within expected bounds. This is a classic driver vulnerability class combining a kernel write primitive with a permissive DACL on the device object.
Attack Vector
Exploitation requires local code execution as a standard user. The attacker opens a handle to the Realtek device object and issues a crafted DeviceIoControl call using the IOCTL_SCSI_PASS_THROUGH code. The malicious SCSI_PASS_THROUGH structure supplies a DataBufferOffset or sense-buffer pointer that references kernel memory. When the driver copies the SCSI response, it writes attacker-controlled bytes to the chosen kernel address.
A working technical writeup is available in the zwclose research blog post covering the RtsPer.sys driver behavior.
No verified public exploit code is included in the NVD record. See the referenced research writeup for technical details on the IOCTL structure abuse.
Detection Methods for CVE-2024-40431
Indicators of Compromise
- Presence of the vulnerable RtsPer.sys driver at a version below 10.0.26100.21374 on production endpoints.
- Unsigned or newly dropped binaries opening handles to Realtek SD card reader device objects.
- Unexpected DeviceIoControl calls issuing IOCTL_SCSI_PASS_THROUGH from non-storage-management processes.
Detection Strategies
- Inventory endpoints for the Realtek SD card reader driver and flag hosts running RtsPer.sys builds earlier than 10.0.26100.21374.
- Alert on user-mode processes that open the Realtek device object outside of legitimate storage or vendor management utilities.
- Correlate driver load events with subsequent token manipulation, credential theft, or SYSTEM-context child processes.
Monitoring Recommendations
- Ingest Windows kernel driver load telemetry (Event ID 6 from Sysmon) into your SIEM and baseline expected Realtek driver versions.
- Monitor for privilege escalation patterns following IOCTL activity to storage-class drivers.
- Review endpoint EDR telemetry for NtDeviceIoControlFile calls targeting the Realtek device from unusual parent processes.
How to Mitigate CVE-2024-40431
Immediate Actions Required
- Update the Realtek SD card reader driver to version 10.0.26100.21374 or later across all affected endpoints.
- Prioritize patching on multi-user systems, developer workstations, and hosts where untrusted code may execute.
- Restrict local user execution of unsigned binaries through application control policies such as Windows Defender Application Control (WDAC) or AppLocker.
Patch Information
Realtek addressed the missing input validation in SD card reader driver version 10.0.26100.21374. Obtain the updated driver through the OEM update channel for the affected hardware platform, or through Windows Update where the driver is distributed via Microsoft. Confirm the deployed driver version by inspecting the file properties of RtsPer.sys.
Workarounds
- Disable or uninstall the Realtek SD card reader driver on systems that do not require SD card functionality.
- Apply Microsoft's vulnerable driver blocklist to prevent load of known-bad RtsPer.sys versions where policy allows.
- Restrict local logon rights on sensitive endpoints to reduce the population of users able to reach the vulnerable IOCTL surface.
# Verify installed Realtek SD card reader driver version on Windows
pnputil /enum-drivers | findstr /I "rtsper"
# Query driver file version directly
powershell -Command "(Get-Item C:\Windows\System32\drivers\RtsPer.sys).VersionInfo.FileVersion"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
