CVE-2024-24977
📋 TL;DR
This vulnerability in Intel License Manager for FLEXlm allows authenticated local users to escalate privileges by manipulating the software's search path. It affects organizations using Intel FLEXlm license management software before version 11.19.5.0.
💻 Affected Systems
- Intel License Manager for FLEXlm
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Authenticated attacker gains SYSTEM/root privileges on the host, enabling complete system compromise and lateral movement.
Likely Case
Authenticated user with standard privileges gains administrative rights on the local system.
If Mitigated
Attack fails due to proper access controls, patched software, or restricted local user permissions.
🎯 Exploit Status
Exploitation requires understanding of DLL/executable search order manipulation and local access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.19.5.0
Vendor Advisory: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01126.html
Restart Required: Yes
Instructions:
1. Download Intel License Manager version 11.19.5.0 or later from Intel support portal. 2. Stop all FLEXlm license services. 3. Install the updated version. 4. Restart license services and verify functionality.
🔧 Temporary Workarounds
Restrict local user permissions
allLimit standard user permissions on systems running Intel License Manager to prevent DLL/executable placement in search paths.
Use application whitelisting
allImplement application control policies to prevent unauthorized executables from running from user-writable directories.
🧯 If You Can't Patch
- Implement strict access controls to limit which users can log into systems running Intel License Manager.
- Monitor for suspicious process creation or privilege escalation attempts using endpoint detection tools.
🔍 How to Verify
Check if Vulnerable:
Check Intel License Manager version via GUI or lmutil -v command. Versions below 11.19.5.0 are vulnerable.Check Version:
lmutil -vVerify Fix Applied:
Confirm version is 11.19.5.0 or higher using lmutil -v command and verify license services are functioning normally.📡 Detection & Monitoring
Log Indicators:
- Unexpected process execution from user-writable directories
- Privilege escalation events in Windows Event Logs or Linux audit logs
Network Indicators:
- Unusual license check patterns if attacker modifies license behavior
SIEM Query:
Process creation where parent process is Intel License Manager and executable path contains user directories