CVE-2019-0155

What it actually does

Insufficient access control in the Intel processor graphics subsystem allows an authenticated local user to escalate privileges by bypassing intended restrictions in the driver.

Why it matters to the business

Systems using affected Intel graphics hardware and drivers face risk of unauthorized privilege escalation from local attackers, which could lead to full system compromise; although published years ago with low EPSS and not in KEV, widespread use in enterprise Linux and Windows environments increases exposure for organizations with legacy hardware.

How an attack unfolds

An attacker with local authenticated access targets the graphics driver subsystem to exploit the access control weakness and obtain elevated privileges, potentially chaining to further actions; no widespread in-the-wild exploitation by named threat actors has been observed despite mentions in vulnerability trend reports.

How to fix it

Update Intel Graphics Driver for Windows to version 26.20.100.6813 (DCH) or 26.20.100.6812 or later, or 21.20.x.5077 or later; update the i915 Linux driver to versions 5.4-rc7, 5.3.11, 4.19.84, 4.14.154, 4.9.201, or 4.4.201 or later; apply all relevant Red Hat Enterprise Linux patches for affected server variants.

How to confirm the fix worked

Confirm installed graphics driver versions match or exceed the fixed releases listed in vendor advisories; review kernel module versions on Linux systems and test that local privilege escalation attempts no longer succeed.

Typical attack path

1. Obtain local authenticated access to a target system
2. Interact with the Intel graphics driver or i915 kernel module
3. Trigger the insufficient access control condition to escalate privileges
4. Execute arbitrary code with higher privileges

How to detect it

Examine system and kernel logs for unusual graphics driver activity or privilege changes around local sessions; review audit logs for unexpected escalations from standard user contexts on affected Intel hardware.

What your security team should do

• Prioritize driver and kernel updates on all systems with affected Intel graphics hardware
• Inventory endpoints for legacy Intel processor generations still in use
• Enforce least-privilege access and monitor for anomalous local process behavior
• Review and apply Red Hat EUS/AUS/TUS patches where applicable