VULNERABILITIES OF REALTEK SD CARD READER DRIVER, PART 1

Summary from the TLDR InfoSec newsletter

The Realtek SD card reader driver has multiple vulnerabilities that allow unauthorized access to kernel memory, including leaking kernel memory and writing to arbitrary kernel addresses. These vulnerabilities can be exploited through specific control codes, such as IOCTL_SCSI_PASS_THROUGH_DIRECT. They enable users to read and write physical memory from user mode via the DMA capability of the device. Exploiting these flaws can lead to significant Windows kernel memory exploration and manipulation.