CVE-2023-50197
Assigner: zdi
Published: 2024-05-03T02:14:22.353Z
State: PUBLISHED
title: Intel Driver & Support Assistant Link Following Local Privilege Escalation Vulnerability
descriptions: value: Intel Driver & Support Assistant Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Intel Driver & Support Assistant. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the DSA Service. By creating a symbolic link, an attacker can abuse the service to write a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-21845.
affected: vendor: Intel
product: Driver & Support Assistant
versions: version: 23.3.25.6
status: affected
defaultStatus: unknown
problemTypes: descriptions: cweId: CWE-59
description: CWE-59: Improper Link Resolution Before File Access ('Link Following')
type: CWE
dateAssigned: 2023-12-05T13:37:59.540-06:00
datePublic: 2023-12-13T12:13:10.483-06:00
source: value: Anonymous
metrics: format: CVSS
cvssV3_0: version: 3.0
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 7.8
baseSeverity: HIGH