CVE-2024-28952
📋 TL;DR
This vulnerability in Intel IPP software for Windows allows authenticated local users to escalate privileges by manipulating the DLL search path. It affects systems running vulnerable versions of Intel IPP software on Windows platforms.
💻 Affected Systems
- Intel Integrated Performance Primitives (IPP) software
📦 What is this software?
Integrated Performance Primitives by Intel
⚠️ Risk & Real-World Impact
Worst Case
An authenticated attacker gains SYSTEM/administrator privileges, enabling complete system compromise, data theft, and persistence mechanisms.
Likely Case
Local authenticated users escalate to higher privileges, potentially installing malware, accessing sensitive data, or bypassing security controls.
If Mitigated
With proper access controls and patching, risk is limited to authorized users who would need to bypass additional security measures.
🎯 Exploit Status
Exploitation requires local authenticated access and knowledge of DLL hijacking techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2021.12.0 or later
Vendor Advisory: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01140.html
Restart Required: Yes
Instructions:
1. Download Intel IPP version 2021.12.0 or later from Intel's website. 2. Uninstall previous versions. 3. Install the updated version. 4. Restart the system.
🔧 Temporary Workarounds
Restrict DLL search path
windowsConfigure Windows to use SafeDllSearchMode and restrict DLL loading from current directory
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v SafeDllSearchMode /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v CWDIllegalInDllSearch /t REG_DWORD /d 0xffffffff /f
🧯 If You Can't Patch
- Implement strict access controls to limit local authenticated users
- Monitor for suspicious DLL loading behavior and privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check Intel IPP version via Control Panel > Programs and Features or using 'wmic product get name,version' commandCheck Version:
wmic product where "name like '%Intel%Performance%Primitives%'" get name,versionVerify Fix Applied:
Verify installed Intel IPP version is 2021.12.0 or later📡 Detection & Monitoring
Log Indicators:
- Windows Event ID 4688 (process creation) showing unexpected DLL loads
- Security logs showing privilege escalation attempts
Network Indicators:
- Not applicable - local privilege escalation
SIEM Query:
EventID=4688 AND (ProcessName="*.exe" AND CommandLine="*DLL*" AND User!="SYSTEM")