PT-2024-8802 · Intel · Intel Neural Compressor

Published 2024-11-12 · Updated 2024-11-15 · CVE-2024-39766

Positive Technologies (AI Summary)

CVSS v4.0

7.3

High

Base vector

AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Intel(R) Neural Compressor versions prior to v3.0

Description: The issue is related to the improper neutralization of special elements used in SQL commands in Intel(R) Neural Compressor software. This may allow an authenticated user to potentially enable escalation of privilege via local access. The vulnerability can also be exploited by a remote attacker to elevate their privileges.

Recommendations: For versions prior to v3.0, update to version v3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the SQL command functionality to minimize the risk of exploitation. Avoid using special elements in SQL commands until the issue is resolved.

Fix

Weakness Enumeration

CWE-1336

Related Identifiers

BDU:2024-10434

CVE-2024-39766

Affected Products

Intel Neural Compressor

References · 6

• https://bdu.fstec.ru/vul/2024-10434 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-39766 · Security Note
• https://t.me/cvedetector/10889 · Telegram Post
• https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01219.html · Note
• https://twitter.com/CVEnew/status/1856808148629115287 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1857025796197478749 · Twitter Post