CVE-2024-28876: 
Intel MPI Library vulnerability analysis and mitigation

CVE-2024-28876 is a security vulnerability discovered in Intel(R) MPI Library software before version 2021.12. The vulnerability was disclosed on August 14, 2024, and affects Intel® MPI Library versions prior to 2021.12 and Intel® oneAPI HPC Toolkit versions prior to 2024.1 (Intel Advisory).

The vulnerability is classified as an uncontrolled search path element issue (CWE-427). It has received a CVSS v3.1 base score of 7.3 (HIGH) from NIST with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. Intel Corporation assigned a slightly lower CVSS score of 6.7 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H (NVD).

If exploited, this vulnerability could allow an authenticated user with local access to escalate privileges on the affected system. The vulnerability affects confidentiality, integrity, and availability of the system, as indicated by the CVSS metrics showing High impact scores for all three security properties (NVD).

The vulnerability requires local access and user interaction for exploitation. An authenticated user with low privileges is needed to execute the attack, and the attack complexity is considered high according to Intel's assessment (Intel Advisory).

Users are advised to update to Intel® MPI Library version 2021.12 or later versions, and Intel® oneAPI HPC Toolkit version 2024.1 or later versions to address this vulnerability (ASEC).