Uncontrolled search path in Intel FPGA OPAE Driver for Linux
Priority LOW 34CWE-427Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-427.
Summary
Improper conditions check in the Intel(R) FPGA OPAE Driver for Linux before kernel version 4.17 may allow an authenticated user to potentially enable escalation of privilege via local access.
Why it matters now
EPSS 0.00292 21st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Intel(R) FPGA OPAE Driver for Linux | See references | — | No fix listed | CNA |
- Intel(R) FPGA OPAE Driver for Linux Vendor— Affected See references Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:intel:trace_analyzer_and_collector:*:*:*:*:*:*:*:* | before 2020 | Vulnerable | Intel |
| cpe:2.3:a:intel:trace_analyzer_and_collector:update1:*:*:*:*:*:*:* | update1 | Vulnerable | Intel |
| cpe:2.3:a:intel:trace_analyzer_and_collector:update2:*:*:*:*:*:*:* | update2 | Vulnerable | Intel |
| cpe:2.3:a:intel:trace_analyzer_and_collector:update3:*:*:*:*:*:*:* | update3 | Vulnerable | Intel |
- cpe:2.3:a:intel:trace_analyzer_and_collector:*:*:*:*:*:*:*:* Versions before 2020 Vulnerable ·Intel
- cpe:2.3:a:intel:trace_analyzer_and_collector:update1:*:*:*:*:*:*:* Versions update1 Vulnerable ·Intel
- cpe:2.3:a:intel:trace_analyzer_and_collector:update2:*:*:*:*:*:*:* Versions update2 Vulnerable ·Intel
- cpe:2.3:a:intel:trace_analyzer_and_collector:update3:*:*:*:*:*:*:* Versions update3 Vulnerable ·Intel
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-24485
- 2026-10-03 Alias added: GHSA-hghg-9hcj-q4j3
References
More Intel Trace Analyzer And Collector vulnerabilities
- TI-2023-17572 Improper access control in Intel oneAPI DPC++/C++ Compiler software CVSS 3.1HIGH 7.8
- TI-2023-14907 Uncontrolled search path in Intel Trace Analyzer and Collector CVSS 3.1HIGH 7.8
- TI-2023-09400 Stack-based buffer overflow in Intel Trace Analyzer and Collector software CVSS 3.1HIGH 7.8
- TI-2023-08617 Uncontrolled search path in Intel oneAPI Toolkit and component software installers CVSS 3.1HIGH 7.8
- TI-2017-03678 Intel PSET Application Install wrapper of Intel Parallel Studio XE, Intel System Studio… CVSS 3.0HIGH 7.3
- TI-2023-13330 Uncontrolled search path in Intel oneAPI Toolkit and component software installers CVSS 3.1HIGH 7.3
Sources
- CVE-2020-24485 · CVE Program
- CVE-2020-24485 · NVD
- FIRST EPSS
- GHSA-hghg-9hcj-q4j3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences