PT-2024-6643 · Intel · Intel Trace Analyzer/Collector

Ycdxsb · Published 2024-08-13 · Updated 2024-09-06 · CVE-2024-28172

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Intel(R) Trace Analyzer and Collector versions prior to 2022.1

Description: The issue is related to an uncontrolled search path in Intel(R) Trace Analyzer and Collector software. This may allow an authenticated user to potentially enable escalation of privilege via local access. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

Recommendations: For versions prior to 2022.1, update to version 2022.1 or later to resolve the issue. As a temporary workaround, consider restricting local access to the software until a patch is applied. Avoid using the software with elevated privileges until the issue is resolved.

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

BDU:2024-07811

CVE-2024-28172

Affected Products

Intel Trace Analyzer/Collector

References · 7

• https://osv.dev/vulnerability/CVE-2024-28172 · Vendor Advisory
• https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01117.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-07811 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-28172 · Security Note
• https://vuldb.com/?id.274602 · Note
• https://t.me/cvedetector/3142 · Telegram Post
• https://twitter.com/CVEnew/status/1823719167205286369 · Twitter Post