The driver RTCore64.sys and RTCore32.sys shipped with Micro-Star MSI Afterburner 4.6.2.15658 exposes read and write access to arbitrary memory, I/O ports, and MSRs. An attacker who is already an authenticated local user can exploit it to escalate privileges, run code with high privileges, or disclose information, and the signed driver can also be abused to get around Microsoft's driver-signing policy and load malicious code.
The driver in Micro-Star MSI Afterburner 4.6.2.15658 (aka RTCore64.sys and RTCore32.sys) allows any authenticated user to read and write to arbitrary memory, I/O ports, and MSRs. This can be exploited for privilege escalation, code execution under high privileges, and information disclosure. These signed drivers can also be used to bypass the Microsoft driver-signing policy to deploy malicious code.
First seen exploited 3 years after disclosure. Public exploit code (PoC-in-GitHub) was available 1 day before disclosure.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
Reports are matched by finding the exact id CVE-2019-16098 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
C:SystemDatarENEgOtiAtES (A vulnerable (CVE-2019-16098) driver RtCore64.sys used to evade detection by installed antivirus software; SHA-256: 01aa278b07b58dc46c84bd0b1b5c8e9ee4e62ea0bf7a695862444af32e87f1fd)
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.