CVE-2023-22355

Description

Uncontrolled search path in some Intel(R) oneAPI Toolkit and component software installers before version 4.3.0.251 may allow an authenticated user to potentially enable escalation of privilege via local access.

Affected (30)

Products: Intel: Advisor, Cpu Runtime, Distribution For Python, Dpc++ Compatibility Tool, Embree Ray Tracing Kernel Library, Fortran Compiler, Implicit Spmd Program Compiler, Inspector, Integrated Performance Primitives, Integrated Performance Primitives Cryptography, Mpi Library, Oneapi Base Toolkit, Oneapi Data Analytics Library, Oneapi Deep Neural Network Library, Oneapi Dpc++/c++ Compiler, Oneapi Dpc++ Library, Oneapi Hpc Toolkit, Oneapi Iot Toolkit, Oneapi Math Kernel Library, Oneapi Rendering Toolkit, Oneapi Threading Building Blocks, Oneapi Toolkit And Component Software Installers, Oneapi Video Processing Library, Open Image Denoise, Open Volume Kernel Library, Ospray, Ospray Studio, Trace Analyzer And Collector, Vtune Profiler

Intel

29 products

Advisor

Cpu Runtime

Distribution For Python

Dpc++ Compatibility Tool

Embree Ray Tracing Kernel Library

Fortran Compiler

Implicit Spmd Program Compiler

Inspector

Integrated Performance Primitives

Integrated Performance Primitives Cryptography

Mpi Library

Oneapi Base Toolkit

Oneapi Data Analytics Library

Oneapi Deep Neural Network Library

Oneapi Dpc++/c++ Compiler

Oneapi Dpc++ Library

Oneapi Hpc Toolkit

Oneapi Iot Toolkit

Oneapi Math Kernel Library

Oneapi Rendering Toolkit

Oneapi Threading Building Blocks

Oneapi Toolkit And Component Software Installers

Oneapi Video Processing Library

Open Image Denoise

Open Volume Kernel Library

Ospray

Ospray Studio

Trace Analyzer And Collector

Vtune Profiler

Configuration A

30 vulnerable

Vulnerable Software	Affected Versions
Intel Advisor	Before 2023.0
Intel Cpu Runtime	Before 2023.0
Intel Distribution For Python	Before 2023.0
Intel Dpc++ Compatibility Tool	Before 2023.0
Intel Embree Ray Tracing Kernel Library	Before 2023.0
Intel Fortran Compiler	Before 2023.0
Intel Implicit Spmd Program Compiler	Before 1.18.1
Intel Inspector	Before 2023.0
Intel Integrated Performance Primitives	Before 2021.7
Intel Integrated Performance Primitives Cryptography	Before 2021.6.3
Intel Mpi Library	Before 2021.8
Intel Oneapi Base Toolkit	Before 2023.0
Intel Oneapi Data Analytics Library	Before 2023.0
Intel Oneapi Deep Neural Network Library	Before 2023.0
Intel Oneapi Dpc++/c++ Compiler	Before 2023.0
Intel Oneapi Dpc++ Library	Before 2022.0
Intel Oneapi Hpc Toolkit	Before 2023.0.0
Intel Oneapi Hpc Toolkit	Version 2023.0.0
Intel Oneapi Iot Toolkit	Before 2023.0
Intel Oneapi Math Kernel Library	Before 2023.0
Intel Oneapi Rendering Toolkit	Before 2023.0
Intel Oneapi Threading Building Blocks	Before 2021.8
Intel Oneapi Toolkit And Component Software Installers	Before 4.3.0.251
Intel Oneapi Video Processing Library	Before 2023.0
Intel Open Image Denoise	Before 1.4.3
Intel Open Volume Kernel Library	Before 2023.0
Intel Ospray	Before 2023.0
Intel Ospray Studio	Before 2023.0
Intel Trace Analyzer And Collector	Before 2021.8.0
Intel Vtune Profiler	Before 2023.0

Related CWEs

CWE-427

Uncontrolled Search Path Element

The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

References (2)

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00819.html

Source: secure@intel.com

Vendor Advisory