Hardware Aware Automated Machinelearning Na
Monthly
Privilege escalation in Intel's Hardware-Aware-Automated-MachineLearning (NA) software before commit 45cd723 stems from an uncontrolled search path element (CWE-427) in its Ring 3 user-space application layer. An unprivileged local attacker who can write to a directory within the application's library or executable search path can plant a malicious artifact; when a high-privileged user subsequently runs the AutoML tool, the application loads the attacker-controlled file and executes code at the elevated privilege level. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the CVSS 4.0 score of 5.4 (Medium) reflects the attack requirements and required user interaction that constrain real-world exploitation.
Privilege escalation in Intel's Hardware-Aware-Automated-MachineLearning (NA) software before commit 45cd723 stems from an uncontrolled search path element (CWE-427) in its Ring 3 user-space application layer. An unprivileged local attacker who can write to a directory within the application's library or executable search path can plant a malicious artifact; when a high-privileged user subsequently runs the AutoML tool, the application loads the attacker-controlled file and executes code at the elevated privilege level. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the CVSS 4.0 score of 5.4 (Medium) reflects the attack requirements and required user interaction that constrain real-world exploitation.