Read the docs
TI-2023-17572 Aliases CVE-2023-35121GHSA-vpq8-9rj2-88fw

Improper access control in Intel oneAPI DPC++/C++ Compiler software

Priority LOW 35CWE-284Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

Improper access control in the Intel(R) oneAPI DPC++/C++ Compiler before version 2022.2.1 for some Intel(R) oneAPI Toolkits before version 2022.3.1 may allow authenticated user to potentially enable escalation of privilege via local access.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00161 5th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Intel(R) oneAPI DPC++/C++ Compiler softwarebefore version 2023.2.1—No fix listedCNA
  • Intel(R) oneAPI DPC++/C++ Compiler software Vendor— Affected before version 2023.2.1 Fixed in — No fix listed CNA

CPE configurations NVD · 18

CPEVersionsRoleVendor
cpe:2.3:a:intel:advisor:*:*:*:*:*:*:*:*before 2023.2VulnerableIntel
cpe:2.3:a:intel:cluster_checker:2021.7.3:*:*:*:*:*:*:*2021.7.3VulnerableIntel
cpe:2.3:a:intel:distribution_for_python:2023.1:*:*:*:*:*:*:*2023.1VulnerableIntel
cpe:2.3:a:intel:inspector:*:*:*:*:*:*:*:*before 2023.2VulnerableIntel
cpe:2.3:a:intel:integrated_performance_primitives:2021.9:*:*:*:*:*:*:*2021.9VulnerableIntel
cpe:2.3:a:intel:integrated_performance_primitives_cryptography:*:*:*:*:*:*:*:*before 2021.8VulnerableIntel
cpe:2.3:a:intel:mpi_library:*:*:*:*:*:*:*:*before 2021.10VulnerableIntel
cpe:2.3:a:intel:oneapi_ai_analytics_toolkit:2023.2:*:*:*:*:*:*:*2023.2VulnerableIntel
cpe:2.3:a:intel:oneapi_base_toolkit:*:*:*:*:*:*:*:*before 2023.2VulnerableIntel
cpe:2.3:a:intel:oneapi_base_toolkit:2023.2:*:*:*:*:*:*:*2023.2VulnerableIntel
  • cpe:2.3:a:intel:advisor:*:*:*:*:*:*:*:* Versions before 2023.2 Vulnerable ·Intel
  • cpe:2.3:a:intel:cluster_checker:2021.7.3:*:*:*:*:*:*:* Versions 2021.7.3 Vulnerable ·Intel
  • cpe:2.3:a:intel:distribution_for_python:2023.1:*:*:*:*:*:*:* Versions 2023.1 Vulnerable ·Intel
  • cpe:2.3:a:intel:inspector:*:*:*:*:*:*:*:* Versions before 2023.2 Vulnerable ·Intel
  • cpe:2.3:a:intel:integrated_performance_primitives:2021.9:*:*:*:*:*:*:* Versions 2021.9 Vulnerable ·Intel
  • cpe:2.3:a:intel:integrated_performance_primitives_cryptography:*:*:*:*:*:*:*:* Versions before 2021.8 Vulnerable ·Intel
  • cpe:2.3:a:intel:mpi_library:*:*:*:*:*:*:*:* Versions before 2021.10 Vulnerable ·Intel
  • cpe:2.3:a:intel:oneapi_ai_analytics_toolkit:2023.2:*:*:*:*:*:*:* Versions 2023.2 Vulnerable ·Intel
  • cpe:2.3:a:intel:oneapi_base_toolkit:*:*:*:*:*:*:*:* Versions before 2023.2 Vulnerable ·Intel
  • cpe:2.3:a:intel:oneapi_base_toolkit:2023.2:*:*:*:*:*:*:* Versions 2023.2 Vulnerable ·Intel
Show 8 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:intel:oneapi_deep_neural_network:*:*:*:*:*:*:*:*before 2023.2VulnerableIntel
cpe:2.3:a:intel:oneapi_deep_neural_network:2023.2:*:*:*:*:*:*:*2023.2VulnerableIntel
cpe:2.3:a:intel:oneapi_hpc_toolkit:2023.2:*:*:*:*:*:*:*2023.2VulnerableIntel
cpe:2.3:a:intel:oneapi_iot_toolkit:2023.2:*:*:*:*:*:*:*2023.2VulnerableIntel
cpe:2.3:a:intel:oneapi_math_kernel_library:*:*:*:*:*:*:*:*before 2023.2VulnerableIntel
cpe:2.3:a:intel:threading_building_blocks:*:*:*:*:*:*:*:*before 2021.10VulnerableIntel
cpe:2.3:a:intel:trace_analyzer_and_collector:2021.10.0:*:*:*:*:*:*:*2021.10.0VulnerableIntel
cpe:2.3:a:intel:vtune_profiler:*:*:*:*:*:-:*:*before 2023.2VulnerableIntel
  • cpe:2.3:a:intel:oneapi_deep_neural_network:*:*:*:*:*:*:*:* Versions before 2023.2 Vulnerable ·Intel
  • cpe:2.3:a:intel:oneapi_deep_neural_network:2023.2:*:*:*:*:*:*:* Versions 2023.2 Vulnerable ·Intel
  • cpe:2.3:a:intel:oneapi_hpc_toolkit:2023.2:*:*:*:*:*:*:* Versions 2023.2 Vulnerable ·Intel
  • cpe:2.3:a:intel:oneapi_iot_toolkit:2023.2:*:*:*:*:*:*:* Versions 2023.2 Vulnerable ·Intel
  • cpe:2.3:a:intel:oneapi_math_kernel_library:*:*:*:*:*:*:*:* Versions before 2023.2 Vulnerable ·Intel
  • cpe:2.3:a:intel:threading_building_blocks:*:*:*:*:*:*:*:* Versions before 2021.10 Vulnerable ·Intel
  • cpe:2.3:a:intel:trace_analyzer_and_collector:2021.10.0:*:*:*:*:*:*:* Versions 2021.10.0 Vulnerable ·Intel
  • cpe:2.3:a:intel:vtune_profiler:*:*:*:*:*:-:*:* Versions before 2023.2 Vulnerable ·Intel

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-35121
  2. 2026-10-03 Alias added: GHSA-vpq8-9rj2-88fw

References

Advisory 1

  • TI-2022-05534 Insufficient control flow management in the Intel(R) Advisor software before version… CVSS 3.1HIGH 7.8
  • TI-2021-05935 Improper access control in the Intel(R) Advisor software before version 2021.2 may allow… CVSS 3.1HIGH 7.8
  • TI-2024-14456 Uncontrolled search path in Intel Advisor software CVSS 3.1HIGH 7.8
  • TI-2023-08617 Uncontrolled search path in Intel oneAPI Toolkit and component software installers CVSS 3.1HIGH 7.8
  • TI-2021-12706 Incorrect default permissions in Intel Advisor CVSS 3.1HIGH 7.8
  • TI-2023-10210 Path traversal in Intel oneAPI Toolkits and Component software CVSS 3.1HIGH 7.8
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences