CVE-2024-29015
📋 TL;DR
This vulnerability in Intel VTune Profiler allows authenticated local users to escalate privileges by manipulating the software's search path. It affects users running vulnerable versions of VTune Profiler on systems where local users have access. The issue stems from uncontrolled DLL/component loading.
💻 Affected Systems
- Intel VTune Profiler
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local authenticated attacker gains SYSTEM/root privileges, enabling complete system compromise, data theft, and persistence.
Likely Case
Local user with standard privileges gains administrative rights, potentially installing malware or accessing restricted data.
If Mitigated
With proper access controls and patching, risk is limited to authorized users only, reducing impact significantly.
🎯 Exploit Status
Exploitation requires local access and basic knowledge of DLL hijacking/search path manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2024.1 or later
Vendor Advisory: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01122.html
Restart Required: Yes
Instructions:
1. Download VTune Profiler 2024.1 or newer from Intel's website. 2. Uninstall previous version. 3. Install new version. 4. Restart system.
🔧 Temporary Workarounds
Restrict local user access
allLimit which local users can run VTune Profiler to reduce attack surface.
Remove vulnerable versions
allUninstall VTune Profiler if not needed or until patched.
🧯 If You Can't Patch
- Restrict VTune Profiler execution to trusted administrators only
- Monitor for suspicious process creation or privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check VTune Profiler version via Help > About in GUI or 'amplxe-cl -version' in terminal.Check Version:
amplxe-cl -versionVerify Fix Applied:
Confirm version is 2024.1 or higher using same methods.📡 Detection & Monitoring
Log Indicators:
- Unexpected VTune Profiler process execution by non-admin users
- Privilege escalation events in Windows Event Log or Linux audit logs
Network Indicators:
- None - local attack only
SIEM Query:
Process creation where parent process contains 'vtune' or 'amplxe' and user privilege changes observed