Intel Graphics Driver up to 10.18/15.33 KMD Module out-of-bounds

Summaryinfo

A vulnerability categorized as problematic has been discovered in Intel Graphics Driver up to 10.18/15.33. This affects an unknown part of the component KMD Module. The manipulation results in out-of-bounds. This vulnerability is reported as CVE-2019-0116. The attack requires a local approach. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Intel Graphics Driver up to 10.18/15.33 (Hardware Driver Software). Affected is an unknown functionality of the component KMD Module. The manipulation with an unknown input leads to a out-of-bounds vulnerability. CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. This is going to have an impact on availability. CVE summarizes:

An out of bound read in KMD module for Intel(R) Graphics Driver before version 10.18.14.5067 (aka 15.36.x.5067) and 10.18.10.5069 (aka 15.33.x.5069) may allow a privileged user to potentially enable denial of service via local access.

The bug was discovered 05/14/2019. The weakness was disclosed 05/17/2019 (Website). The advisory is shared for download at securityfocus.com. This vulnerability is traded as CVE-2019-0116 since 11/13/2018. The attack needs to be approached locally. The successful exploitation needs a authentication. There are neither technical details nor an exploit publicly available.

The vulnerability was handled as a non-public zero-day exploit for at least 3 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 10.18.10.5069 or 10.18.14.5067 eliminates this vulnerability.

The entries VDB-135189, VDB-135190 and VDB-135191 are pretty similar. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Hardware Driver Software

Vendor

• Intel

Name

• Graphics Driver

Version

• 10.0
• 10.1
• 10.2
• 10.3
• 10.4
• 10.5
• 10.6
• 10.7
• 10.8
• 10.9
• 10.10
• 10.11
• 10.12
• 10.13
• 10.14
• 10.15
• 10.16
• 10.17
• 10.18
• 15.0
• 15.1
• 15.2
• 15.3
• 15.4
• 15.5
• 15.6
• 15.7
• 15.8
• 15.9
• 15.10
• 15.11
• 15.12
• 15.13
• 15.14
• 15.15
• 15.16
• 15.17
• 15.18
• 15.19
• 15.20
• 15.21
• 15.22
• 15.23
• 15.24
• 15.25
• 15.26
• 15.27
• 15.28
• 15.29
• 15.30
• 15.31
• 15.32
• 15.33

License

• commercial

Website

• Vendor: https://www.intel.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion