CVE-2021-33092
📋 TL;DR
This vulnerability allows authenticated local users to escalate privileges on Intel NUC M15 Laptop Kit systems due to incorrect default permissions in the HID Event Filter driver installer. Attackers could gain SYSTEM-level access by exploiting overly permissive file permissions. Only systems with the vulnerable driver pack installed are affected.
💻 Affected Systems
- Intel NUC M15 Laptop Kit HID Event Filter driver pack
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local authenticated attacker gains SYSTEM privileges, enabling complete system compromise, persistence installation, credential theft, and lateral movement.
Likely Case
Malicious insider or compromised user account escalates to administrative privileges to install malware, disable security controls, or access sensitive data.
If Mitigated
With proper access controls and least privilege principles, impact is limited to users who already have local access to vulnerable systems.
🎯 Exploit Status
Exploitation requires local authenticated access and knowledge of the vulnerable file locations. No public exploit code has been released.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.2.1.383 or later
Vendor Advisory: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00569.html
Restart Required: Yes
Instructions:
1. Download updated driver pack from Intel Driver & Support Assistant or Intel website. 2. Run installer with administrative privileges. 3. Follow on-screen instructions. 4. Restart system when prompted.
🔧 Temporary Workarounds
Remove vulnerable driver
windowsUninstall the HID Event Filter driver if not required for system functionality
Control Panel > Programs > Uninstall a program > Intel HID Event Filter Driver > Uninstall
Adjust file permissions
windowsManually set restrictive permissions on driver files and directories
icacls "C:\Windows\System32\drivers\IntelHIDEventFilter.sys" /inheritance:r /grant:r "SYSTEM:(F)" "Administrators:(F)" "Users:(RX)"
🧯 If You Can't Patch
- Implement strict least privilege access controls to limit local user permissions
- Monitor for suspicious privilege escalation attempts using endpoint detection tools
🔍 How to Verify
Check if Vulnerable:
Check driver version in Device Manager under Human Interface Devices > Intel HID Event Filter, or check file properties of C:\Windows\System32\drivers\IntelHIDEventFilter.sysCheck Version:
powershell Get-WmiObject Win32_PnPSignedDriver | Where-Object {$_.DeviceName -like '*Intel HID Event Filter*'} | Select-Object DeviceName, DriverVersionVerify Fix Applied:
Verify driver version is 2.2.1.383 or higher and check file permissions show proper restrictive settings📡 Detection & Monitoring
Log Indicators:
- Windows Security Event ID 4688 (process creation) showing privilege escalation attempts
- Sysmon Event ID 1 showing execution of privileged processes from user accounts
Network Indicators:
- No network indicators - local privilege escalation only
SIEM Query:
source="windows_security" event_id=4688 AND (process_name="cmd.exe" OR process_name="powershell.exe") AND integrity_level="System" AND user!="SYSTEM"