PT-2024-8766 · Intel · Intel Neural Compressor

Published 2024-11-12 · Updated 2024-11-15 · CVE-2024-28028

Positive Technologies (AI Summary)

CVSS v4.0

7.7

High

Base vector

AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Intel Neural Compressor versions prior to v3.0

Description: The issue is related to improper input validation in the Intel Neural Compressor software, which may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access. This is due to errors in processing input data.

Recommendations: For versions prior to v3.0, update to version v3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the Intel Neural Compressor software to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2024-10381

CVE-2024-28028

Affected Products

Intel Neural Compressor

References · 5

• https://bdu.fstec.ru/vul/2024-10381 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-28028 · Security Note
• https://twitter.com/VulmonFeeds/status/1856969473875640423 · Twitter Post
• https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01219.html · Note
• https://twitter.com/CVEnew/status/1856808149832835467 · Twitter Post