PT-2023-1618 · Intel · Intel C++ Compiler Classic+2

Cristiano Giuffrida + 4 · Published 2023-01-10 · Updated 2023-03-17 · CVE-2022-40196

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Intel(R) oneAPI DPC++/C++ Compiler versions prior to 2022.2.1 Intel C++ Compiler Classic versions prior to 2021.7.1 Intel(R) oneAPI Toolkits versions prior to 2022.3.1

Description The issue is related to improper access control in the Intel(R) oneAPI DPC++/C++ Compiler and Intel C++ Compiler Classic, which may allow an authenticated user to potentially enable escalation of privilege via local access. This vulnerability is associated with deficiencies in access control, which can be exploited by an attacker to elevate their privileges.

Recommendations For Intel(R) oneAPI DPC++/C++ Compiler versions prior to 2022.2.1, update to version 2022.2.1 or later. For Intel C++ Compiler Classic versions prior to 2021.7.1, update to version 2021.7.1 or later. For Intel(R) oneAPI Toolkits versions prior to 2022.3.1, update to version 2022.3.1 or later.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2023-01127

CVE-2022-40196

Affected Products

Intel C++ Compiler Classic

Intel Oneapi Dpc++/C++ Compiler

Intel Oneapi Toolkit

References · 4

• https://osv.dev/vulnerability/CVE-2022-40196 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01127 · Security Note
• https://intel.com/content/www/us/en/security-center/advisory/intel-sa-00773.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-40196 · Security Note