Vulnerability CVE-2018-18089


Published: 2019-03-14

Description:
Multiple out of bounds read in igdkm64.sys in Intel(R) Graphics Driver for Windows* before versions 10.18.x.5059 (aka 15.33.x.5059), 10.18.x.5057 (aka 15.36.x.5057), 20.19.x.5063 (aka 15.40.x.5063) 21.20.x.5064 (aka 15.45.x.5064) and 24.20.100.6373 may allow an authenticated user to potentially enable information disclosure via local access.

Type:

CWE-125

(Out-of-bounds Read)

Vendor: Intel
Product: Graphics driver 
Version:
24.20.100.6286
24.20.100.6229
24.20.100.6194
24.20.100.6136
24.20.100.6094
24.20.100.6025
15.45.23.4860
15.45.21.4821
15.45.19.4678
15.45.18.4664
15.40.41.5058
15.40.38.4963
15.40.37.4835
15.40.36.4703
15.40.34.4624
15.36.34.4889
15.36.33.4578
15.36.31.4414
15.36.28.4332
15.36.26.4294
15.33.46.4885
15.33.45.4653
15.33.43.4425

CVSS2 => (AV:L/AC:L/Au:N/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
2.1/10
2.9/10
3.9/10
Exploit range
Attack complexity
Authentication
Local
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None

 References:
https://support.lenovo.com/us/en/product_security/LEN-25084
https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00189.html

Related CVE
CVE-2019-11184
A race condition in specific microprocessors using Intel (R) DDIO cache allocation and RDMA may allow an authenticated user to potentially enable partial information disclosure via adjacent access.
CVE-2019-11166
Improper file permissions in the installer for Intel(R) Easy Streaming Wizard before version 2.1.0731 may allow an authenticated user to potentially enable escalation of privilege via local attack.
CVE-2019-11163
Insufficient access control in a hardware abstraction driver for Intel(R) Processor Identification Utility for Windows before version 6.1.0731 may allow an authenticated user to potentially enable escalation of privilege, denial of service or informa...
CVE-2019-11148
Improper permissions in the installer for Intel(R) Remote Displays SDK before version 2.0.1 R2 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2019-11143
Improper permissions in the software installer for Intel(R) Authenticate before 3.8 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2019-11140
Insufficient session validation in system firmware for Intel(R) NUC may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.
CVE-2019-0173
Authentication bypass in the web console for Intel(R) Raid Web Console 2 all versions may allow an unauthenticated attacker to potentially enable disclosure of information via network access.
CVE-2019-11129
Out of bound read/write in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.

Copyright 2019, cxsecurity.com

 

Back to Top