Intel Battery Life Diagnostic Tool Privilege Escalation Vulnerabilities (CVE-2023-34430/32662/2022-38786)

Intel ID: INTEL-SA-00843 Advisory Category: Software Impact of Vulnerability: Escalation of Privilege Severity Rating: MEDIUM Original Release: 11/14/2023 Last Revised: 11/14/2023 Summary Potential security vulnerabilities in some Intel® Battery Life Diagnostic Tool software may allow escalation of privilege. Intel is releasing software updates to mitigate these potential vulnerabilities. Vulnerability Details CVEID: CVE-2023-34430 - Description: Uncontrolled search path in some Intel® Battery Life Diagnostic Tool software before version 2.2.1 may allow an authenticated user to potentially enable escalation of privilege via local access. - CVSS Base Score: 6.7 Medium - CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H CVEID: CVE-2023-32662 - Description: Improper authorization in some Intel® Battery Life Diagnostic Tool installation software before version 2.2.1 may allow a privileged user to potentially enable escalation of privilege via local access. - CVSS Base Score: 6.7 Medium - CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVEID: CVE-2022-38786 - Description: Improper access control in some Intel® Battery Life Diagnostic Tool software before version 2.2.1 may allow an authenticated user to potentially enable escalation of privilege via local access. - CVSS Base Score: 6.7 Medium - CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H Affected Products Intel® Battery Life Diagnostic Tool software before version 2.2.1. Recommendation Intel recommends updating Intel® Battery Life Diagnostic Tool software to version 2.2.1 or later. Updates are available for download at this location: https://cdrdv2.intel.com/v1/dl/getContent/777224/782477 Acknowledgements Intel would like to thank ycdxsb of VARAS@IIE (CVE-2023-34430), Marius Gabriel Mihai (CVE-2023-32662) and Aobo Wang of Chaitin Security Research Lab (CVE-2022-38786) for reporting these issues. Revision History

Goal Reached Thanks to every supporter — we hit 100%!

Intel Battery Life Diagnostic Tool Privilege Escalation Vulnerabilities (CVE-2023-34430/32662/2022-38786)