According to the researchers, the vulnerability CVE-2019-19705 could allow an attacker to execute malicious code. The flaw affected the “HD Audio Background Process” (RAVBg64.exe) that executed as NT AUTHORITY\SYSTEM. Upon execution, the process tried to load missing DLL files.
Once executed, the process tries to load RAVBg64ENU.dll and RAVBg64LOC.dll (which are not located in) its own directory.At this point, an attacker with admin privileges could upload an arbitrary DLL and execute malicious code. This became possible due to the lack of signature validation and the use of outdated software.
The researchers have shared the proof-of-concept for this vulnerability in their advisory.
As confirmed in the Realtek’s advisory, the bug affected the Realtek HD Audio Driver version Legacy (non-DCH type) driver 1.0.0.8855. Hence, all PCs bearing the Realtek sound cards became vulnerable to the flaw.
Consequently, the vendors patched the flaw with the release of Realtek High Definition Audio Driver Legacy (non-DCH) driver 1.0.0.8856.
Users must ensure that their systems are running the latest version of Realtek HD Audio Driver to stay protected from potential exploitation.
Earlier, SafeBreach Labs also reported similar bugs in the numerous antivirus programs and other software such as TeamViewer.
Let us know your thoughts in the comments.
