CVE-2024-28046
📋 TL;DR
This vulnerability in Intel GPA software allows authenticated local users to escalate privileges by manipulating the software's search path. It affects users running vulnerable versions of Intel GPA software on their systems. Attackers could gain higher system permissions than intended.
💻 Affected Systems
- Intel(R) Graphics Performance Analyzers (GPA)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An authenticated attacker could achieve full system compromise (SYSTEM/root access) by placing malicious DLLs in locations searched by Intel GPA software.
Likely Case
Local authenticated users could elevate privileges to install software, modify system settings, or access restricted data.
If Mitigated
With proper access controls and patching, impact is limited to denial of service or minimal privilege escalation.
🎯 Exploit Status
Exploitation requires local authenticated access and knowledge of DLL hijacking techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2024.1 or later
Vendor Advisory: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01105.html
Restart Required: Yes
Instructions:
1. Download Intel GPA version 2024.1 or later from Intel's website
2. Uninstall previous versions
3. Install the updated version
4. Restart the system
🔧 Temporary Workarounds
Restrict DLL search path
windowsConfigure system to restrict DLL search paths for Intel GPA executables
Use Windows Group Policy or AppLocker to restrict DLL loading
Set DLL search order to safe directories only
Remove vulnerable software
windowsUninstall Intel GPA if not required
Control Panel > Programs > Uninstall Intel GPA
Or use: msiexec /x {Intel-GPA-Product-Code}
🧯 If You Can't Patch
- Restrict local user access to systems with Intel GPA installed
- Implement strict DLL whitelisting policies
- Monitor for suspicious DLL loading events
🔍 How to Verify
Check if Vulnerable:
Check Intel GPA version in installed programs list or run 'gpa --version' from command lineCheck Version:
gpa --versionVerify Fix Applied:
Verify installed version is 2024.1 or later and check that DLL search path vulnerabilities are mitigated📡 Detection & Monitoring
Log Indicators:
- DLL loading from unusual locations by GPA processes
- Process creation with elevated privileges from GPA executables
- Failed DLL loading attempts from restricted paths
Network Indicators:
- Not applicable - local vulnerability only
SIEM Query:
Process creation where parent_process contains 'gpa' AND integrity_level changed