CVE-2023-27383

Vulnerability

A protection mechanism failure exists in Intel(R) oneAPI HPC Toolkit 2023.1 and Intel(R) MPI Library software before version 2021.9 [1]. The flaw allows a privileged attacker with adjacent network access to bypass security controls, potentially enabling privilege escalation in environments where the affected components are deployed.

Exploitation

The attacker must already have privileged access (e.g., administrative rights on the local system) and be able to communicate with the target from an adjacent network segment [1]. The exact attack vector is not detailed in the available references, but the vulnerability is exploitable without user interaction, as it resides in a protection mechanism that should prevent certain privileged operations from being abused.

Impact

Successful exploitation enables the attacker to escalate their privileges further, potentially gaining capabilities beyond those normally allowed for the initial privileged account [1]. This could lead to full compromise of the affected system or sensitive data exposure, depending on the deployment context.

Mitigation

Intel recommends updating Intel(R) MPI Library to version 2021.9 or later, and Intel(R) oneAPI HPC Toolkit to a version that includes the fix [1]. Users should apply these updates as soon as possible. No workarounds have been published for this vulnerability. The CVE is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date.