Uncontrolled search path in Intel oneAPI DPC++/C++ Compiler allows privilege escalation
A vulnerability in Intel oneAPI DPC++/C++ Compiler versions before 2024.2 allows authenticated users with local access to potentially escalate privileges through an uncontrolled search path. Intel released patched versions and recommended users update to version 2024.2 or later.
What happened
A potential security vulnerability in Intel oneAPI DPC++/C++ Compiler versions before 2024.2 involves an uncontrolled search path that may allow an authenticated user to escalate privileges via local access.
The vulnerability affects Intel oneAPI Base Toolkit, Intel HPC Toolkit, Intel oneAPI DPC++/C++ Compiler, and Intel Fortran Compiler all before version 2024.2. Intel released software updates to mitigate the vulnerability on 11/12/2024.
Reported impact
The vulnerability could enable escalation of privilege for an authenticated user with local access to the system.
Index analysis
The vulnerability requires local access and user interaction, resulting in a CVSS Base Score 3.1 of 6.7 (Medium severity).
Governance controls
Intel recommends updating affected products to version 2024.2 or later. The vulnerability was discovered by ycdxsb through coordinated disclosure.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.