PT-2024-8767 · Intel · Intel Extension For Transformers

Sunrisexu · Published 2024-11-12 · Updated 2024-11-15 · CVE-2024-21799

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Intel(R) Extension for Transformers versions prior to 1.5

Description: The issue is related to path traversal in the Intel(R) Extension for Transformers software, which may allow an authenticated user to potentially enable escalation of privilege via local access. This is due to incorrect restriction of the directory path name with limited access. Exploitation of the issue may allow an attacker to elevate their privileges.

Recommendations: For versions prior to 1.5, update to version 1.5 or later to resolve the issue. As a temporary workaround, consider restricting local access to the software to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2024-10382

CVE-2024-21799

Affected Products

Intel Extension For Transformers

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-21799 · Security Note
• https://bdu.fstec.ru/vul/2024-10382 · Security Note
• https://vulners.com/cvelist/CVELIST:CVE-2024-21799 · Note
• https://twitter.com/CVEnew/status/1856808168136843618 · Twitter Post
• https://t.me/cvenotify/101611 · Telegram Post
• https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01190.html · Note