Untrusted search path in Intel products - CVE-2024-21830

Vulnerability identifier: #VU107011

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-21830

CWE-ID: CWE-426

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to usage of an untrusted search path in Intel VPL software. A local user can place a malicious binary into a specific location on the system and execute arbitrary code with escalated privileges.

11th Generation Intel Core Processors
12th Generation Intel Core Processors
13th Generation Intel Core Processors
14th Generation Intel Core Processors
7th Gen Intel Core Processors
8th Gen Intel Core processor
10th Generation Intel Core Processors
Intel Core Processors with Intel Hybrid Technology
Intel Atom Processors
Intel Pentium Processors
Intel Celeron Processors
Intel Iris Xe Dedicated Graphics
Intel Data Center GPU Flex 140
Intel Data Center GPU Flex 170
9th Generation Intel Core Processors
Intel Arc Graphics family
Intel Core Ultra processor
Intel Arc Pro Graphics for Windows
Intel oneAPI Video Processing Library

Install updates from vendor's website.

7th Gen Intel Core Processors - update to 31.0.101.2130
8th Gen Intel Core processor - update to 31.0.101.2130
9th Generation Intel Core Processors - update to 31.0.101.2130
10th Generation Intel Core Processors - update to 31.0.101.2130
Intel Core Processors with Intel Hybrid Technology - update to 31.0.101.2130
Intel Atom Processors - update to 31.0.101.2130
Intel Pentium Processors - update to 31.0.101.2130
Intel Celeron Processors - update to 31.0.101.2130
Intel Iris Xe Dedicated Graphics - update to 31.0.101.5186_101.5234
Intel Arc Graphics family - update to 31.0.101.5186_101.5234
Intel Core Ultra processor - update to 31.0.101.5186_101.5234
Intel Arc Pro Graphics for Windows - update to 31.0.101.5319
Intel Data Center GPU Flex 140 - update to 31.0.101.5333
Intel Data Center GPU Flex 170 - update to 31.0.101.5333
Intel oneAPI Video Processing Library - update to 2023.4.0

• https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01044.html

• Privilege escalation in Intel VPL Software