CVE-2019-0155
📋 TL;DR
This vulnerability allows an authenticated user to potentially escalate privileges via local access due to insufficient access control in Intel processor graphics subsystems. It affects multiple Intel processor families and graphics drivers across Windows and Linux systems. Exploitation could lead to unauthorized system control.
💻 Affected Systems
- Intel Core Processors (6th-9th Gen)
- Intel Pentium Processors (J, N, Silver, Gold Series)
- Intel Celeron Processors (J, N, G3900, G4900 Series)
- Intel Atom Processors (A, E3900 Series)
- Intel Xeon Processors (E3-1500 v5/v6, E-2100, E-2200)
- Intel Graphics Driver for Windows
- i915 Linux Driver for Intel Processor Graphics
📦 What is this software?
Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
An authenticated attacker gains full system administrator/root privileges, enabling complete system compromise, data theft, and persistence.
Likely Case
Local authenticated user escalates privileges to gain unauthorized access to sensitive system resources or other user accounts.
If Mitigated
With proper access controls and patching, impact is limited to denial of service or minimal privilege escalation.
🎯 Exploit Status
Requires local authenticated access and knowledge of the vulnerability. No public exploit code identified in references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Windows: 26.20.100.6813 (DCH) or 26.20.100.6812 and 21.20.x.5077 or later; Linux: 5.4-rc7, 5.3.11, 4.19.84, 4.14.154, 4.9.201, 4.4.201 or later
Vendor Advisory: https://access.redhat.com/errata/RHSA-2019:3841
Restart Required: Yes
Instructions:
1. Identify affected systems using version_check_command. 2. Download updated drivers from Intel or OS vendor. 3. Install updated graphics drivers. 4. Reboot system to apply changes. 5. Verify installation with verification commands.
🔧 Temporary Workarounds
Restrict Local User Access
allLimit local user accounts and implement least privilege principles to reduce attack surface.
Disable Intel Graphics if Not Needed
allIf system has dedicated graphics and doesn't require Intel integrated graphics, disable it in BIOS/UEFI.
🧯 If You Can't Patch
- Implement strict access controls and monitor for privilege escalation attempts
- Segment affected systems and limit lateral movement capabilities
🔍 How to Verify
Check if Vulnerable:
Check graphics driver version against affected versions. On Linux: check kernel version with 'uname -r'. On Windows: check driver version in Device Manager under Display adapters.Check Version:
Linux: 'uname -r'; Windows: 'wmic path win32_pnpentity get caption,driverVersion' or check Device ManagerVerify Fix Applied:
Confirm driver/kernel version is updated to patched versions. Test privilege escalation attempts should fail.📡 Detection & Monitoring
Log Indicators:
- Unexpected privilege escalation events
- Failed authorization attempts on graphics subsystem
- Driver loading/unloading anomalies
Network Indicators:
- None - local exploit only
SIEM Query:
Search for events related to graphics driver access, privilege changes, or unauthorized system calls from non-admin users.🔗 References
- http://packetstormsecurity.com/files/155375/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
- https://access.redhat.com/errata/RHSA-2019:3841
- https://access.redhat.com/errata/RHSA-2019:3887
- https://access.redhat.com/errata/RHSA-2019:3889
- https://access.redhat.com/errata/RHSA-2019:3908
- https://access.redhat.com/errata/RHSA-2020:0204
- https://seclists.org/bugtraq/2019/Nov/26
- https://security.netapp.com/advisory/ntap-20200320-0005/
- https://support.f5.com/csp/article/K73659122?utm_source=f5support&%3Butm_medium=RSS
- https://usn.ubuntu.com/4186-2/
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00242.html
- http://packetstormsecurity.com/files/155375/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
- https://access.redhat.com/errata/RHSA-2019:3841
- https://access.redhat.com/errata/RHSA-2019:3887
- https://access.redhat.com/errata/RHSA-2019:3889
- https://access.redhat.com/errata/RHSA-2019:3908
- https://access.redhat.com/errata/RHSA-2020:0204
- https://seclists.org/bugtraq/2019/Nov/26
- https://security.netapp.com/advisory/ntap-20200320-0005/
- https://support.f5.com/csp/article/K73659122?utm_source=f5support&%3Butm_medium=RSS
- https://usn.ubuntu.com/4186-2/
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00242.html
