CVE-2022-40196
📋 TL;DR
This vulnerability allows authenticated users with local access to potentially escalate privileges on systems running affected Intel compiler versions. It affects users of Intel oneAPI DPC++/C++ Compiler before version 2022.2.1 and Intel C++ Compiler Classic before version 2021.7.1.
💻 Affected Systems
- Intel oneAPI DPC++/C++ Compiler
- Intel C++ Compiler Classic
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An authenticated attacker could gain SYSTEM/root privileges and fully compromise the host system.
Likely Case
Privilege escalation from standard user to administrator/root access on the local system.
If Mitigated
No impact if proper access controls and patching are implemented.
🎯 Exploit Status
Requires authenticated local access and knowledge of the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: oneAPI DPC++/C++ Compiler 2022.2.1+, C++ Compiler Classic 2021.7.1+
Vendor Advisory: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00773.html
Restart Required: Yes
Instructions:
1. Update to Intel oneAPI Toolkit version 2022.3.1 or later. 2. Update individual compilers to patched versions. 3. Restart affected systems.
🔧 Temporary Workarounds
Restrict local user access
allLimit local user accounts and implement least privilege access controls.
Disable compiler services
allTemporarily disable compiler services if not actively needed.
systemctl stop intel-compiler-services
sc stop "Intel Compiler Service"
🧯 If You Can't Patch
- Implement strict access controls and limit local user privileges
- Monitor for suspicious privilege escalation attempts and compiler service activity
🔍 How to Verify
Check if Vulnerable:
Check compiler version: icpx --version or icc --versionCheck Version:
icpx --version 2>&1 | head -1Verify Fix Applied:
Verify version is 2022.2.1+ for DPC++/C++ or 2021.7.1+ for Classic📡 Detection & Monitoring
Log Indicators:
- Unexpected privilege escalation events
- Compiler service access by non-admin users
Network Indicators:
- Local privilege escalation attempts
SIEM Query:
EventID=4672 OR EventID=4688 on Windows with compiler process names