CVE-2023-42099
Assigner: zdi
Published: 2024-05-03T02:13:11.158Z
State: PUBLISHED
title: Intel Driver & Support Assistant Link Following Local Privilege Escalation Vulnerability
descriptions: value: Intel Driver & Support Assistant Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Intel Driver & Support Assistant. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the DSA Service. By creating a symbolic link, an attacker can abuse the service to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-21846.
affected: vendor: Intel
product: Driver & Support Assistant
versions: version: 23.3.25.6
status: affected
defaultStatus: unknown
problemTypes: descriptions: cweId: CWE-59
description: CWE-59: Improper Link Resolution Before File Access ('Link Following')
type: CWE
dateAssigned: 2023-09-06T16:25:45.367-05:00
datePublic: 2023-09-21T13:10:14.369-05:00
source: value: Anonymous
metrics: format: CVSS
cvssV3_0: version: 3.0
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 7.8
baseSeverity: HIGH