CVE-2023-23909 Information disclosure in Intel(R) Trace Analyzer and Collector software

Low 2.8 Published 10 May 2023 Updated 27 Jan 2025

An authenticated local user can exploit an out-of-bounds read in Intel Trace Analyzer to disclose sensitive information.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2023-23909?

CVE-2023-23909 is a low-severity vulnerability in Intel(R) Trace Analyzer and Collector software, published on 10 May 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Out-of-bounds read for some Intel(R) Trace Analyzer and Collector software before version 2021.8.0 published Dec 2022 may allow an authenticated user to potentially enable information disclosure via local access.

Weakness: CWE-125

Which versions are affected by CVE-2023-23909?

It affects 2 products.

Products include Intel Oneapi Hpc Toolkit, Intel Trace Analyzer and Collector.

How do I fix CVE-2023-23909?

No fix has been published for CVE-2023-23909 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-23909 being exploited?

There is no known exploitation of CVE-2023-23909 in the wild and no public exploit code.

Sources

Also known as GHSA-96j5-rxm2-2j66.