Intel oneAPI Math Kernel Library (oneMKL): An uncontrolled library search path: the component loads a shared library

CVSS 6.7CVE-2024-21766Kernel, userspace & hypervisorcurated

Impact

An uncontrolled library search path: the component loads a shared library by name from a directory a non-root user can write. Anyone who can drop a file in that directory gets code execution in the context of whoever next runs the tool - which on an AI node is usually a privileged installer, a service account, or root.

Who can reach it

A local authenticated user on a node that has the toolkit installed. On shared build/dev nodes and on container images built from the Intel toolkits, that is a broad set of people.

What to do

Upgrade the affected component and, just as importantly, audit directory permissions on already-provisioned nodes and container images - upgrading the package does not remove a writable directory an earlier install created. Userspace only: no reboot, no BIOS, no microcode. Rebuild base images rather than patching running nodes.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-21766 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01072.html

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.