A vulnerability Intel has addressed in the Rapid Storage Technology (RST) could allow a local user to escalate privileges to System.
Intel RST is a Windows-based application that is provided with many computers that feature Intel chips to deliver improved performance and reliability when SATA disks are used.
Discovered by SafeBreach, the security flaw can be abused to bypass defenses and achieve persistence through loading an arbitrary unsigned DLL into a process that runs with System privileges. The issue, however, requires for the attacker to have administrative privileges on the system.
The vulnerability is similar to issues recently disclosed in products from Kaspersky, McAfee, Symantec, Avast and Avira, and allows an attacker to place a malicious DLL onto the affected system and have it loaded into a privileged process.
Specifically, SafeBreach’ security researchers discovered that IAStorDataMgrSvc.exe, a process pertaining to Intel RST, and which is signed and runs with System privileges, attempts to load no less than four DLLs that are missing from its directories.
Thus, all that the researchers had to do was to build their own DLL and then place it at a path where the Intel signed process attempts to load libraries from.
“The root cause of this vulnerability is that no signature validation is made against the DLL files which the service tries to load. Because the files do no exit, an attacker can implant arbitrary DLL files and the service will load them,” SafeBreach explains.
By exploiting this issue, an attacker could load and execute a malicious payload while evading detection. Furthermore, the payload could be executed in a persistent way, each time the service is started, the researchers point out.
Intel has confirmed that the vulnerability impacts Intel RST iterations before 17.7.0.1006 and recommends updating to a patched version as soon as possible. The security bug is tracked as CVE-2019-14568 and it has a CVSS score of 6.7.
Related: Vulnerabilities Disclosed in Kaspersky, Trend Micro Products
Related: DLL Hijacking Flaw Patched in Check Point Endpoint Security