CVE-2024-34165: 
Intel oneAPI DPC++/C++ Compiler vulnerability analysis and mitigation

An uncontrolled search path vulnerability was discovered in Intel(R) oneAPI DPC++/C++ Compiler versions prior to 2024.2. The vulnerability was disclosed on November 13, 2024, and is tracked as CVE-2024-34165. This security flaw affects Intel's oneAPI DPC++/C++ Compiler software suite (Intel Advisory).

The vulnerability is classified as CWE-427 (Uncontrolled Search Path Element). It has received a CVSS v4.0 base score of 5.4 (Medium) with vector string CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, and a CVSS v3.1 score of 6.7 (Medium) with vector string CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H. These scores indicate that the vulnerability requires local access and high attack complexity (NVD).

If successfully exploited, this vulnerability could enable an authenticated user to escalate privileges through local access. The high severity ratings for confidentiality, integrity, and availability impacts (VC:H/VI:H/VA:H) in the CVSS v4.0 scoring indicate potential significant consequences if exploited (Intel Advisory).

The vulnerability requires local access (AV:L) and high attack complexity (AC:H), with low privileges (PR:L) and user interaction (UI:R) needed for exploitation. The attack requires an authenticated user with local access to the system (NVD).

Intel has addressed this vulnerability in version 2024.2 of the oneAPI DPC++/C++ Compiler. Users are advised to upgrade to this version or later to mitigate the security risk (Intel Advisory).