Database/Control plane, storage & DevOps
Intel oneAPI DPC++/C++ compiler: An uncontrolled library search path: the component loads a shared library by name
Impact
An uncontrolled library search path: the component loads a shared library by name from a directory a non-root user can write. Anyone who can drop a file in that directory gets code execution in the context of whoever next runs the tool - which on an AI node is usually a privileged installer, a service account, or root.
Who can reach it
A local authenticated user on a node that has the toolkit installed. On shared build/dev nodes and on container images built from the Intel toolkits, that is a broad set of people.
What to do
Upgrade the affected component and, just as importantly, audit directory permissions on already-provisioned nodes and container images - upgrading the package does not remove a writable directory an earlier install created. Userspace only: no reboot, no BIOS, no microcode. Rebuild base images rather than patching running nodes.
References
Related entries
- Intel oneAPI DPC++/C++ compiler: An uncontrolled library search path: the component loads a shared library by nameCVE-2025-20627 · Intel oneAPI DPC++/C++ compilerMedium
- Intel oneAPI toolkit and component installers: An uncontrolled library search path: the component loads a sharedCVE-2025-20017 · Intel oneAPI toolkit and component installersMedium
- Intel oneAPI DPC++/C++ compiler installer: The compiler installer sets permissions that let a local user modifyCVE-2025-20087 · Intel oneAPI DPC++/C++ compiler installerMedium
- Intel E810 NVM Update Utility: Insecure inherited permissions in the NVM update utilityCVE-2025-20629 · Intel E810 NVM Update UtilityMedium
- Dell CloudLink (privilege escalation to database): A privileged user escalates laterally or reads the CloudLinkCVE-2025-46366 · Dell CloudLink (privilege escalation to database)Medium
- Dell CloudLink (risky cryptographic primitive): Use of a cryptographic primitive with a risky implementationCVE-2025-46424 · Dell CloudLink (risky cryptographic primitive)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.