CVE-2021-33094
📋 TL;DR
This vulnerability allows authenticated local users to escalate privileges on Intel NUC M15 Laptop Kit systems due to insecure inherited permissions in the Keyboard LED Service driver installer. Attackers could gain SYSTEM-level access by exploiting improper file/folder permissions. Only systems with the vulnerable driver pack installed are affected.
💻 Affected Systems
- Intel NUC M15 Laptop Kit Keyboard LED Service driver pack
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Authenticated attacker gains SYSTEM privileges, enabling complete system compromise, persistence installation, credential theft, and lateral movement.
Likely Case
Local user or malware with standard privileges escalates to administrative/SYSTEM rights to bypass security controls.
If Mitigated
With proper patching and least privilege principles, impact is limited to denial of service at most.
🎯 Exploit Status
Exploitation requires authenticated local access and knowledge of vulnerable file locations. No public exploit code available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.0.4 or later
Vendor Advisory: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00569.html
Restart Required: Yes
Instructions:
1. Download driver version 1.0.0.4 or later from Intel's website. 2. Run the installer with administrative privileges. 3. Restart the system when prompted.
🔧 Temporary Workarounds
Remove vulnerable driver
windowsUninstall the Keyboard LED Service driver pack if not needed
Control Panel > Programs > Uninstall a program > Select 'Intel NUC M15 Laptop Kit Keyboard LED Service' > Uninstall
Restrict file permissions
windowsManually set proper permissions on driver installation directories
icacls "C:\Program Files\Intel\Keyboard LED Service\*" /inheritance:r /grant:r "SYSTEM:(OI)(CI)F" "Administrators:(OI)(CI)F" /deny "Users:(OI)(CI)F"
🧯 If You Can't Patch
- Implement least privilege principles - ensure users don't have unnecessary local admin rights
- Monitor for privilege escalation attempts using Windows Event Logs and EDR solutions
🔍 How to Verify
Check if Vulnerable:
Check driver version in Device Manager under 'System devices' > 'Intel NUC M15 Laptop Kit Keyboard LED Service' or check installed programs list.Check Version:
wmic path Win32_PnPSignedDriver where "DeviceName like '%Keyboard LED%'" get DeviceName, DriverVersionVerify Fix Applied:
Verify driver version is 1.0.0.4 or later and check file permissions on installation directory.📡 Detection & Monitoring
Log Indicators:
- Windows Security Event ID 4688 (process creation) with parent-child privilege escalation patterns
- Unexpected SYSTEM privilege processes launched by standard users
Network Indicators:
- No network indicators - local privilege escalation only
SIEM Query:
source="windows_security" event_id=4688 (process_name="*" AND integrity_level="System") AND user_name!="SYSTEM"