Improper access control in Intel oneAPI Toolkit and component software installers
Priority LOW 31CWE-284Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-284.
Summary
Improper access control in some Intel(R) oneAPI Toolkit and component software installers before version 4.3.1.493 may allow a privileged user to potentially enable escalation of privilege via local access.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00179 7th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Intel(R) oneAPI Toolkit and component software installers | before version 4.3.1.493 | — | No fix listed | CNA |
- Intel(R) oneAPI Toolkit and component software installers Vendor— Affected before version 4.3.1.493 Fixed in — No fix listed CNA
CPE configurations NVD · 29
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:intel:advisor_for_oneapi:*:*:*:*:*:*:*:* | before 2023.1 | Vulnerable | Intel |
| cpe:2.3:a:intel:cpu_runtime_for_opencl_applications:*:*:*:*:*:*:*:* | before 2023.1 | Vulnerable | Intel |
| cpe:2.3:a:intel:distribution_for_python_programming_language:*:*:*:*:*:*:*:* | before 2023.1 | Vulnerable | Intel |
| cpe:2.3:a:intel:dpc\+\+_compatibility_tool:*:*:*:*:*:*:*:* | before 2023.1 | Vulnerable | Intel |
| cpe:2.3:a:intel:embree_ray_tracing_kernel_library:*:*:*:*:*:*:*:* | before 2023.1 | Vulnerable | Intel |
| cpe:2.3:a:intel:fortran_compiler:*:*:*:*:*:*:*:* | before 2023.1 | Vulnerable | Intel |
| cpe:2.3:a:intel:implicit_spmd_program_compiler:*:*:*:*:*:*:*:* | before 1.19.1 | Vulnerable | Intel |
| cpe:2.3:a:intel:inspector_for_oneapi:*:*:*:*:*:*:*:* | before 2023.1 | Vulnerable | Intel |
| cpe:2.3:a:intel:integrated_performance_primitives:*:*:*:*:*:*:*:* | before 2021.8 | Vulnerable | Intel |
| cpe:2.3:a:intel:ipp_cryptography:*:*:*:*:*:*:*:* | before 2021.7.0 | Vulnerable | Intel |
- cpe:2.3:a:intel:advisor_for_oneapi:*:*:*:*:*:*:*:* Versions before 2023.1 Vulnerable ·Intel
- cpe:2.3:a:intel:cpu_runtime_for_opencl_applications:*:*:*:*:*:*:*:* Versions before 2023.1 Vulnerable ·Intel
- cpe:2.3:a:intel:distribution_for_python_programming_language:*:*:*:*:*:*:*:* Versions before 2023.1 Vulnerable ·Intel
- cpe:2.3:a:intel:dpc\+\+_compatibility_tool:*:*:*:*:*:*:*:* Versions before 2023.1 Vulnerable ·Intel
- cpe:2.3:a:intel:embree_ray_tracing_kernel_library:*:*:*:*:*:*:*:* Versions before 2023.1 Vulnerable ·Intel
- cpe:2.3:a:intel:fortran_compiler:*:*:*:*:*:*:*:* Versions before 2023.1 Vulnerable ·Intel
- cpe:2.3:a:intel:implicit_spmd_program_compiler:*:*:*:*:*:*:*:* Versions before 1.19.1 Vulnerable ·Intel
- cpe:2.3:a:intel:inspector_for_oneapi:*:*:*:*:*:*:*:* Versions before 2023.1 Vulnerable ·Intel
- cpe:2.3:a:intel:integrated_performance_primitives:*:*:*:*:*:*:*:* Versions before 2021.8 Vulnerable ·Intel
- cpe:2.3:a:intel:ipp_cryptography:*:*:*:*:*:*:*:* Versions before 2021.7.0 Vulnerable ·Intel
Show 19 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:intel:mpi_library:*:*:*:*:*:*:*:* | before 2021.9.0 | Vulnerable | Intel |
| cpe:2.3:a:intel:oneapi_base_toolkit:*:*:*:*:*:*:*:* | before 2023.1 | Vulnerable | Intel |
| cpe:2.3:a:intel:oneapi_data_analytics_library:*:*:*:*:*:*:*:* | before 2023.1 | Vulnerable | Intel |
| cpe:2.3:a:intel:oneapi_deep_neural_network_library:*:*:*:*:*:*:*:* | before 2023.1 | Vulnerable | Intel |
| cpe:2.3:a:intel:oneapi_dpc\+\+\/c\+\+_compiler:*:*:*:*:*:*:*:* | before 2023.1 | Vulnerable | Intel |
| cpe:2.3:a:intel:oneapi_dpc\+\+_library_\(onedpl\):*:*:*:*:*:*:*:* | before 2022.1 | Vulnerable | Intel |
| cpe:2.3:a:intel:oneapi_hpc_toolkit:*:*:*:*:*:*:*:* | before 2023.1 | Vulnerable | Intel |
| cpe:2.3:a:intel:oneapi_iot_toolkit:*:*:*:*:*:*:*:* | before 2023.1 | Vulnerable | Intel |
| cpe:2.3:a:intel:oneapi_math_kernel_library:*:*:*:*:*:*:*:* | before 2023.1 | Vulnerable | Intel |
| cpe:2.3:a:intel:oneapi_rendering_toolkit:*:*:*:*:*:*:*:* | before 2023.1 | Vulnerable | Intel |
| cpe:2.3:a:intel:oneapi_threading_building_blocks:*:*:*:*:*:*:*:* | before 2021.9.0 | Vulnerable | Intel |
| cpe:2.3:a:intel:oneapi_toolkit_and_component_software_installer:*:*:*:*:*:*:*:* | before 4.3.1.493 | Vulnerable | Intel |
| cpe:2.3:a:intel:oneapi_video_processing_library:*:*:*:*:*:*:*:* | before 2023.1 | Vulnerable | Intel |
| cpe:2.3:a:intel:open_image_denoise:*:*:*:*:*:*:*:* | before 1.4.3 | Vulnerable | Intel |
| cpe:2.3:a:intel:open_volume_kernel_library:*:*:*:*:*:*:*:* | before 2023.1 | Vulnerable | Intel |
| cpe:2.3:a:intel:ospray:*:*:*:*:*:*:*:* | before 2023.1 | Vulnerable | Intel |
| cpe:2.3:a:intel:ospray_studio:*:*:*:*:*:*:*:* | before 2023.1 | Vulnerable | Intel |
| cpe:2.3:a:intel:trace_analyzer_and_collector:*:*:*:*:*:*:*:* | before 2021.9.0 | Vulnerable | Intel |
| cpe:2.3:a:intel:vtune_profiler_for_oneapi:*:*:*:*:*:*:*:* | before 2023.1 | Vulnerable | Intel |
- cpe:2.3:a:intel:mpi_library:*:*:*:*:*:*:*:* Versions before 2021.9.0 Vulnerable ·Intel
- cpe:2.3:a:intel:oneapi_base_toolkit:*:*:*:*:*:*:*:* Versions before 2023.1 Vulnerable ·Intel
- cpe:2.3:a:intel:oneapi_data_analytics_library:*:*:*:*:*:*:*:* Versions before 2023.1 Vulnerable ·Intel
- cpe:2.3:a:intel:oneapi_deep_neural_network_library:*:*:*:*:*:*:*:* Versions before 2023.1 Vulnerable ·Intel
- cpe:2.3:a:intel:oneapi_dpc\+\+\/c\+\+_compiler:*:*:*:*:*:*:*:* Versions before 2023.1 Vulnerable ·Intel
- cpe:2.3:a:intel:oneapi_dpc\+\+_library_\(onedpl\):*:*:*:*:*:*:*:* Versions before 2022.1 Vulnerable ·Intel
- cpe:2.3:a:intel:oneapi_hpc_toolkit:*:*:*:*:*:*:*:* Versions before 2023.1 Vulnerable ·Intel
- cpe:2.3:a:intel:oneapi_iot_toolkit:*:*:*:*:*:*:*:* Versions before 2023.1 Vulnerable ·Intel
- cpe:2.3:a:intel:oneapi_math_kernel_library:*:*:*:*:*:*:*:* Versions before 2023.1 Vulnerable ·Intel
- cpe:2.3:a:intel:oneapi_rendering_toolkit:*:*:*:*:*:*:*:* Versions before 2023.1 Vulnerable ·Intel
- cpe:2.3:a:intel:oneapi_threading_building_blocks:*:*:*:*:*:*:*:* Versions before 2021.9.0 Vulnerable ·Intel
- cpe:2.3:a:intel:oneapi_toolkit_and_component_software_installer:*:*:*:*:*:*:*:* Versions before 4.3.1.493 Vulnerable ·Intel
- cpe:2.3:a:intel:oneapi_video_processing_library:*:*:*:*:*:*:*:* Versions before 2023.1 Vulnerable ·Intel
- cpe:2.3:a:intel:open_image_denoise:*:*:*:*:*:*:*:* Versions before 1.4.3 Vulnerable ·Intel
- cpe:2.3:a:intel:open_volume_kernel_library:*:*:*:*:*:*:*:* Versions before 2023.1 Vulnerable ·Intel
- cpe:2.3:a:intel:ospray:*:*:*:*:*:*:*:* Versions before 2023.1 Vulnerable ·Intel
- cpe:2.3:a:intel:ospray_studio:*:*:*:*:*:*:*:* Versions before 2023.1 Vulnerable ·Intel
- cpe:2.3:a:intel:trace_analyzer_and_collector:*:*:*:*:*:*:*:* Versions before 2021.9.0 Vulnerable ·Intel
- cpe:2.3:a:intel:vtune_profiler_for_oneapi:*:*:*:*:*:*:*:* Versions before 2023.1 Vulnerable ·Intel
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-27391
- 2026-10-03 Alias added: GHSA-vcwv-3m76-7vfq
References
More Intel Advisor For Oneapi vulnerabilities
- TI-2023-13330 Uncontrolled search path in Intel oneAPI Toolkit and component software installers CVSS 3.1HIGH 7.3
Sources
- CVE-2023-27391 · CVE Program
- CVE-2023-27391 · NVD
- FIRST EPSS
- GHSA-vcwv-3m76-7vfq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences