CVE-2024-40431

A lack of input validation in Realtek SD card reader driver before 10.0.26100.21374 through the implementation of the IOCTL_SCSI_PASS_THROUGH control of the SD card reader driver allows an attacker to write to predictable kernel memory locations, even as a low-privileged user.

Score

CVSS 3.1 8.8 High

Status

Deferred - cve@mitre.org

Published

2024-10-23

Last modified

2024-10-24

Affected products

• Sd Card Reader Driver (Realtek)

References

• https://zwclose.github.io/2024/10/14/rtsper1.html