Skip to main content

CVE-2024-45067: Escalation of Privilege in Intel(R) Gaudi(R) software installers

Medium
VulnerabilityCVE-2024-45067cvecve-2024-45067
Published: Wed May 14 2025 (05/14/2025, 22:16:43 UTC)
Source: CVE
Vendor/Project: n/a
Product: Intel(R) Gaudi(R) software installers

Description

Incorrect default permissions in some Intel(R) Gaudi(R) software installers before version 1.18 may allow an authenticated user to potentially enable escalation of privilege via local access.

AI-Powered Analysis

AILast updated: 07/04/2025, 15:13:00 UTC

Technical Analysis

CVE-2024-45067 is a medium-severity vulnerability affecting Intel(R) Gaudi(R) software installers prior to version 1.18. The issue stems from incorrect default permissions set on certain installer components, which may allow an authenticated local user to escalate their privileges on the affected system. Specifically, the vulnerability requires that the attacker already has some level of authenticated access (local access with limited privileges) and can exploit the improper permission settings to gain higher privileges, potentially administrative or root-level. The vulnerability does not require network access and involves local exploitation with user interaction. The CVSS 4.0 vector indicates low attack complexity and privileges required are low, but user interaction is necessary. The impact on confidentiality, integrity, and availability is high, meaning that a successful exploit could allow an attacker to fully control the system or manipulate sensitive data. However, there are no known exploits in the wild at this time, and no patches or mitigation links have been provided yet. Intel Gaudi is a specialized AI training accelerator platform, so this vulnerability primarily affects environments using this hardware and associated software installers, typically in data centers or research institutions deploying AI workloads.

Potential Impact

For European organizations, especially those involved in AI research, data centers, and enterprises deploying Intel Gaudi accelerators, this vulnerability poses a risk of local privilege escalation. An attacker with limited access (e.g., a low-privileged user or a compromised account) could leverage this flaw to gain administrative control over the system, potentially leading to unauthorized access to sensitive AI models, training data, or intellectual property. This could result in data breaches, disruption of AI workloads, or manipulation of AI outputs. Given the increasing adoption of AI technologies across Europe, including in countries with strong AI research sectors such as Germany, France, and the Netherlands, the impact could be significant if exploited. The vulnerability does not directly allow remote exploitation, so the threat is more relevant in environments where multiple users have local access or where attackers have already penetrated the network perimeter.

Mitigation Recommendations

Organizations should prioritize upgrading Intel Gaudi software installers to version 1.18 or later as soon as it becomes available to address the incorrect default permissions. Until patches are released, administrators should audit and manually correct file and directory permissions related to the Gaudi software installers to ensure that only authorized users have write or execute permissions. Implement strict access controls and monitoring on systems running Gaudi software to detect unusual privilege escalation attempts. Employ the principle of least privilege for user accounts and restrict local access to trusted personnel only. Additionally, consider deploying endpoint detection and response (EDR) solutions to identify suspicious local activities. Regularly review and update security policies related to AI infrastructure and ensure that all software components are kept up to date with vendor advisories.

Need more detailed analysis?Get Pro

Technical Details

Data Version
5.1
Assigner Short Name
intel
Date Reserved
2024-10-09T02:59:22.175Z
Cisa Enriched
true
Cvss Version
4.0
State
PUBLISHED

Threat ID: 682cd0f81484d88663aeb8ad

Added to database: 5/20/2025, 6:59:04 PM

Last enriched: 7/4/2025, 3:13:00 PM

Last updated: 8/16/2025, 12:06:24 AM

Views: 10

Actions

PRO

Updates to AI analysis are available only with a Pro account. Contact root@offseq.com for access.

Please log in to the Console to use AI analysis features.

Need enhanced features?

Contact root@offseq.com for Pro access with improved analysis and higher rate limits.

Latest Threats