Gaudi Container Runtime
Monthly
Path traversal in Intel's gaudi-container-runtime before version 1.24.0 enables privilege escalation for locally authenticated users running workloads on Intel Gaudi AI accelerator hardware. The CWE-22 path traversal flaw resides in the Ring 3 userspace component of the runtime, allowing a low-privileged attacker to traverse directory boundaries and potentially gain elevated access with full confidentiality, integrity, and availability impact on the vulnerable system. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 5.4 reflects the local attack vector, required attack preconditions (AT:P), and passive user interaction requirement, which substantially reduce real-world exploitability despite the high per-system impact.
Path traversal in Intel's gaudi-container-runtime before version 1.24.0 enables privilege escalation for locally authenticated users running workloads on Intel Gaudi AI accelerator hardware. The CWE-22 path traversal flaw resides in the Ring 3 userspace component of the runtime, allowing a low-privileged attacker to traverse directory boundaries and potentially gain elevated access with full confidentiality, integrity, and availability impact on the vulnerable system. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 5.4 reflects the local attack vector, required attack preconditions (AT:P), and passive user interaction requirement, which substantially reduce real-world exploitability despite the high per-system impact.