CVE-2024-23907: 
Intel oneAPI DPC++/C++ Compiler vulnerability analysis and mitigation

An uncontrolled search path vulnerability (CVE-2024-23907) was discovered in Intel® High Level Synthesis Compiler software versions prior to 23.4. This vulnerability affects multiple Intel products including Intel® High Level Synthesis Compiler, Intel® Quartus® Prime Pro Edition Design software, and Intel® DPC++ C++ Compiler software (Intel Advisory).

The vulnerability is classified as CWE-427 (Uncontrolled Search Path Element) with a CVSS v3.1 base score of 7.8 (HIGH) according to NIST's assessment. The vulnerability requires local access and low privileges for exploitation, with no user interaction needed for successful exploitation (NVD).

If successfully exploited, this vulnerability could allow an authenticated user with local access to escalate privileges on the affected system (Intel Advisory, NVD).

The vulnerability requires local access and low privileges for exploitation. The attack complexity is considered low according to the CVSS metrics, though no known exploits in the wild have been reported (NVD).

Intel has released updates to address this vulnerability. Users are advised to update to Intel® High Level Synthesis Compiler software version 23.4 or later, Intel® Quartus® Prime Pro Edition Design software version 23.4 or later, and Intel® DPC++ C++ Compiler software version 2024.1 or later (ASEC).