CVE-2019-11112
📋 TL;DR
This vulnerability allows an authenticated user to exploit memory corruption in Intel Graphics Kernel Mode Drivers to potentially escalate privileges via local access. It affects systems with Intel Graphics Drivers before specific versions. Attackers could gain higher system privileges than intended.
💻 Affected Systems
- Intel Graphics Drivers
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with administrative privileges, allowing installation of malware, data theft, or persistence mechanisms.
Likely Case
Local privilege escalation allowing authenticated users to gain administrative rights on the affected system.
If Mitigated
Limited impact if proper access controls and least privilege principles are enforced, though exploitation could still occur.
🎯 Exploit Status
Requires local authenticated access and knowledge of memory corruption exploitation techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 26.20.100.6813 (DCH) or 26.20.100.6812 and later
Vendor Advisory: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00242.html
Restart Required: Yes
Instructions:
1. Download latest Intel Graphics Driver from Intel website. 2. Run installer. 3. Follow on-screen instructions. 4. Restart system when prompted.
🔧 Temporary Workarounds
Restrict local user privileges
windowsApply least privilege principle to limit authenticated users' capabilities
🧯 If You Can't Patch
- Implement strict access controls and limit local user privileges
- Monitor systems for unusual privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check Intel Graphics Driver version in Device Manager > Display adapters > Intel Graphics > Driver tabCheck Version:
wmic path win32_pnpsigneddriver where "devicename like '%Intel%Graphics%'" get devicename, driverversionVerify Fix Applied:
Verify driver version is 26.20.100.6813 or higher (DCH) or 26.20.100.6812 or higher📡 Detection & Monitoring
Log Indicators:
- Unexpected privilege escalation events
- Driver loading failures
- System crash dumps related to graphics driver
Network Indicators:
- None - local exploitation only
SIEM Query:
EventID=4672 OR EventID=4688 with privileged account creation from non-admin users