CVE-2018-12219
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
Insufficient input validation in Kernel Mode Driver in Intel(R) Graphics Driver for Windows* before versions 10.18.x.5059 (aka 15.33.x.5059), 10.18.x.5057 (aka 15.36.x.5057), 20.19.x.5063 (aka 15.40.x.5063) 21.20.x.5064 (aka 15.45.x.5064) and 24.20.100.6373 potentially enables an unprivileged user to read memory via local access via local access.
Risk Assessment
A local attacker could read kernel memory contents, potentially leading to disclosure of sensitive information such as credentials or keys. This may compromise system confidentiality.
Recommendation
Update the Intel Graphics Driver to version 10.18.x.5059, 10.18.x.5057, 20.19.x.5063, 21.20.x.5064, 24.20.100.6373 or later. Restrict local access to the system for untrusted users.
Other vulnerabilities in Intel Graphics Driver
See all- CVE-2017-7163High
An issue was discovered in certain Apple products, including macOS before version 10.13.2, related to the 'Intel Graphics Driver' component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
- CVE-2017-7155High
An issue was discovered in certain Apple products, including macOS before 10.13.2, related to the 'Intel Graphics Driver' component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
- CVE-2017-13883High
An issue was discovered in certain Apple products, including macOS before version 10.13.2, related to the 'Intel Graphics Driver' component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
- CVE-2017-13878High
An issue was discovered in certain Apple products, including macOS before 10.13.2, related to the 'Intel Graphics Driver' component. It allows local users to bypass intended memory-read restrictions or cause a denial of service (out-of-bounds read and system crash).
- CVE-2017-13875High
An issue was discovered in certain Apple products, including macOS before 10.13.2, related to the 'Intel Graphics Driver' component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (out-of-bounds read) via a crafted app.
- CVE-2017-5717High
A 'Type Confusion' vulnerability in the Content Protection HECI Service in Intel Graphics Driver allows an unprivileged user to elevate privileges via local access.
- CVE-2017-7044High
An issue was discovered in certain Apple products, including macOS before 10.12.6, related to the 'Intel Graphics Driver' component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
- CVE-2017-7035High
An issue was discovered in certain Apple products, including macOS before 10.12.6, related to the 'Intel Graphics Driver' component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
- CVE-2017-7017High
An issue was discovered in certain Apple products, including macOS before 10.12.6, related to the 'Intel Graphics Driver' component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
- CVE-2017-7014High
An issue was discovered in certain Apple products, including macOS before 10.12.6, related to the 'Intel Graphics Driver' component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Original NVD description (English source)
Insufficient input validation in Kernel Mode Driver in Intel(R) Graphics Driver for Windows* before versions 10.18.x.5059 (aka 15.33.x.5059), 10.18.x.5057 (aka 15.36.x.5057), 20.19.x.5063 (aka 15.40.x.5063) 21.20.x.5064 (aka 15.45.x.5064) and 24.20.100.6373 potentially enables an unprivileged user to read memory via local access via local access.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS