CVE-2016-20085: Realtek High Definition Audio Driver 6.0.1.6730 Privilege Escalation
Realtek High Definition Audio Driver 6.0.1.6730 contains an unquoted service path vulnerability that allows local attackers to escalate privileges by placing a malicious executable in the service path. Attackers can insert an executable file in the unquoted path and restart the service to execute code with LocalSystem privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure the service ImagePath for the Realtek High Definition Audio Driver is a fully quoted, absolute path (enclose the entire executable path in "quotes") so that Windows does not treat unquoted path elements as executable search locations.
Realtek High Definition Audio Driver (service ImagePath) ImagePath (service binary path quoting) = quoted path - Configuration
Remove or deny Create/Write/Modify permissions for non-administrative users on every directory referenced in the service ImagePath so local attackers cannot place a malicious executable into the service path.
Service path directories (NTFS) write_permissions = remove write access for non-administrative users - Compensating control
Restrict which accounts can stop/start/restart the Realtek service by adjusting the service ACL to limit restart/control to administrators or trusted service accounts only, preventing unprivileged users from restarting the service to trigger execution.
- Operational
Inspect the directories in the service path for any unauthorized or suspicious executable files and remove them; if malicious files are found, perform appropriate incident response and remediation for possible privilege escalation.
Event History
Frequently Asked Questions
What is the severity of CVE-2016-20085?
The severity of CVE-2016-20085 is rated as high with a score of 8.5.
How do I fix CVE-2016-20085?
To fix CVE-2016-20085, update the Realtek High Definition Audio Driver to a version that addresses the unquoted service path vulnerability.
What type of vulnerability is CVE-2016-20085?
CVE-2016-20085 is a privilege escalation vulnerability caused by an unquoted service path in the Realtek High Definition Audio Driver.
Who can exploit CVE-2016-20085?
CVE-2016-20085 can be exploited by local attackers with low privileges.
What can attackers achieve by exploiting CVE-2016-20085?
By exploiting CVE-2016-20085, attackers can escalate their privileges and potentially execute malicious code in the context of a higher privilege level.