CVE-2023-28823
Medium
Description
Uncontrolled search path in some Intel(R) oneAPI Toolkit and component software installers before version 4.3.1.493 may allow an authenticated user to potentially enable escalation of privilege via local access.
SeverityMedium
CVSS6.7
Exploit probability—
ProductIntel Oneapi Base Toolkit
PublishedAug 11, 2023
First seenAug 11, 2023
Weakness typeCWE-427CWE-427
How to fix
Update
- intel oneapi_base_toolkit2023.1 or later
- intel advisor_for_oneapi2023.1 or later
- intel cpu_runtime_for_opencl_applications2023.1 or later
- intel distribution_for_python_programming_language2023.1 or later
- intel dpc\+\+_compatibility_tool2023.1 or later
- intel embree_ray_tracing_kernel_library2023.1 or later
- intel fortran_compiler2023.1 or later
- intel implicit_spmd_program_compiler1.19.1 or later
- intel inspector_for_oneapi2023.1 or later
- intel integrated_performance_primitives2021.8 or later
- intel ipp_cryptography2021.7.0 or later
- intel mpi_library2021.9.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| intel oneapi_base_toolkit | v < 2023.1 | 2023.1 |
| intel advisor_for_oneapi | v < 2023.1 | 2023.1 |
| intel cpu_runtime_for_opencl_applications | v < 2023.1 | 2023.1 |
| intel distribution_for_python_programming_language | v < 2023.1 | 2023.1 |
| intel dpc\+\+_compatibility_tool | v < 2023.1 | 2023.1 |
| intel embree_ray_tracing_kernel_library | v < 2023.1 | 2023.1 |
| intel fortran_compiler | v < 2023.1 | 2023.1 |
| intel implicit_spmd_program_compiler | v < 1.19.1 | 1.19.1 |
| intel inspector_for_oneapi | v < 2023.1 | 2023.1 |
| intel integrated_performance_primitives | v < 2021.8 | 2021.8 |
| intel ipp_cryptography | v < 2021.7.0 | 2021.7.0 |
| intel mpi_library | v < 2021.9.0 | 2021.9.0 |
| intel oneapi_data_analytics_library | v < 2023.1 | 2023.1 |
| intel oneapi_deep_neural_network_library | v < 2023.1 | 2023.1 |
| intel oneapi_dpc\+\+\/c\+\+_compiler | v < 2023.1 | 2023.1 |
| intel oneapi_dpc\+\+_library_\(onedpl\) | v < 2022.1 | 2022.1 |
| intel oneapi_hpc_toolkit | v < 2023.1 | 2023.1 |
| intel oneapi_iot_toolkit | v < 2023.1 | 2023.1 |
| intel oneapi_math_kernel_library | v < 2023.1 | 2023.1 |
| intel oneapi_rendering_toolkit | v < 2023.1 | 2023.1 |
| intel oneapi_threading_building_blocks | v < 2021.9.0 | 2021.9.0 |
| intel oneapi_toolkit_and_component_software_installer | v < 4.3.1.493 | 4.3.1.493 |
| intel oneapi_video_processing_library | v < 2023.1 | 2023.1 |
| intel open_image_denoise | v < 1.4.3 | 1.4.3 |
| intel open_volume_kernel_library | v < 2023.1 | 2023.1 |
| intel ospray | v < 2023.1 | 2023.1 |
| intel ospray_studio | v < 2023.1 | 2023.1 |
| intel trace_analyzer_and_collector | v < 2021.9.0 | 2021.9.0 |
| intel vtune_profiler_for_oneapi | v < 2023.1 | 2023.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.