Intel has patched 19 vulnerabilities across its popular graphics drivers for Windows 10, including two high-severity flaws.
CVE-2018-12216 and CVE-2018-12214 could both allow a privileged user to execute arbitrary code via local access, according to an Intel advisory.
“Multiple potential security vulnerabilities in Intel Graphics Driver for Windows may allow escalation of privileges, denial-of-service or information disclosure,” Intel said in a Tuesday security advisory. “Intel is releasing Intel Graphics Driver for Windows updates to mitigate these potential vulnerabilities.”
The graphics driver is a program that controls how graphic components work with the rest of the computer. Intel develops graphics drivers for Windows OS to communicate with specific Intel graphics devices, for instance.
The more serious of these (CVE-2018-12216) has a CVSS score of 8.2 and stems from insufficient input validation in the kernel mode driver within Intel Graphics Driver for Windows. The kernel mode driver of a graphics driver executes any instruction it needs on the CPU without waiting, and can reference any memory address that is available.
The flaw exists in versions prior to 10.18.x.5059 (aka 15.33.x.5059), 10.18.x.5057 (aka 15.36.x.5057), 20.19.x.5063 (aka 15.40.x.5063) 21.20.x.5064 (aka 15.45.x.5064) and 24.20.100.6373.
The other high-severity vulnerability (CVE-2018-12214) has a CVSS score of 7.3 and exists due to potential memory corruption in the same kernel mode driver.
Impacted versions are those previous to 10.18.x.5059 (aka 15.33.x.5059), 10.18.x.5057 (aka 15.36.x.5057), 20.19.x.5063 (aka 15.40.x.5063) 21.20.x.5064 (aka 15.45.x.5064) and 24.20.100.6373.
For all drivers, Intel recommends that users of Intel Graphics Driver for Windows update to versions 10.18.x.5059 (aka 15.33.x.5059), 10.18.x.5057 (aka 15.36.x.5057), 20.19.x.5063 (aka 15.40.x.5063) 21.20.x.5064 (aka 15.45.x.5064) and 24.20.100.6373 or later.
“This isn’t the first time we’ve seen a vulnerability of this magnitude with Intel, and at this point I think many people have already prepared themselves for the possibility that it’s not the last, either,” Bryan Becker, application security researcher at WhiteHat Security, told Threatpost. “A vulnerability in CPU architecture is one of the most insidious, as there is very little users can do to protect themselves, short of just not using it until a patch comes out.”
Overall Security Update
The graphics driver patches are part of a larger set of fixes across seven Intel products, including its Matrix Storage Manager, Active Management Technology and Accelerated Storage Manager.
Five of these products included high-severity vulnerabilities. For instance, Intel patched a slew of high-severity escalation of privilege vulnerabilities in its firmware that could lead to denial-of-service or information disclosure; and a flaw in Intel Accelerated Storage Manager in Rapid Storage Technology enterprise (RSTe) that may allow escalation of privilege.
Two other of the seven flaws were rated medium in severity, including an escalation of privilege flaw (CVE-2019-0129) in Intel’s USB 3.0 creator utility that exists due to improper permissions (Intel is ultimately discontinuing the hosting and support of this tool).
The other medium-rated vulnerability is a denial-of-service and information-disclosure flaw in Intel’s software guard extensions SDK (CVE-2019-0122).
“Double free in Intel SGX SDK for Linux before version 2.2 and Intel SGX SDK for Windows before version 2.1 may allow an authenticated user to potentially enable information disclosure or denial of service via local access,” Intel’s advisory said.
Intel told Threatpost it is not aware of any of the vulnerabilities being used in real-world exploits.
Don’t miss our free live Threatpost webinar, “Exploring the Top 15 Most Common Vulnerabilities with HackerOne and GitHub,” on Wed., Mar 20, at 2:00 p.m. ET.
Vulnerability experts Michiel Prins, co-founder of webinar sponsor HackerOne, and Greg Ose, GitHub’s application security engineering manager, will join Threatpost editor Tom Spring to discuss what vulnerability types are most common in today’s software, and what kind of impact they would have on organizations if exploited.