CVE-2018-12216

Vulnerability

The vulnerability [1] resides in the Kernel Mode Driver (igdkmd64.sys) component of the Intel Graphics Driver for Windows. Insufficient input validation allows a privileged user to trigger a buffer-related condition leading to arbitrary code execution. Affected versions include: 10.18.x.5059 (15.33.x.5059), 10.18.x.5057 (15.36.x.5057), 20.19.x.5063 (15.40.x.5063), 21.20.x.5064 (15.45.x.5064), and 24.20.100.6373, and prior versions.

Exploitation

An attacker must have local access to the system with administrative privileges. The attacker can then craft a call to the vulnerable graphics driver IOCTL or similar interface, supplying a specially crafted input that bypasses the insufficient validation. This triggers a memory corruption or buffer overflow in kernel space, allowing the attacker to redirect execution flow.

Impact

Successful exploitation allows the attacker to execute arbitrary code with kernel privileges (SYSTEM). This results in a complete compromise of confidentiality, integrity, and availability of the affected system. The attacker could install programs, view, change, or delete data, or create new accounts with full user rights.

Mitigation

Intel released fixed versions as listed in the advisory [1]: 10.18.x.5059, 10.18.x.5057, 20.19.x.5063, 21.20.x.5064, 24.20.100.6373 and later. Users should update their Intel Graphics Driver through the Intel Driver & Support Assistant or the device manufacturer's support site. No workaround is available; patching is the only mitigation.