CVE-2022-26076

What it actually does

Uncontrolled search path element in oneDNN allows an authenticated local user to cause the application to load an attacker-controlled library from a writable directory searched before the legitimate path, resulting in arbitrary code execution with the privileges of the oneDNN process.

Why it matters to the business

Attackers who already have a local foothold can obtain higher privileges on developer or ML-training workstations, increasing the chance of data theft, model tampering, or lateral movement within environments that use Intel oneAPI for deep-learning workloads.

How an attack unfolds

An attacker with a local user account on a system running a vulnerable oneDNN version places a malicious DLL in a directory that precedes the legitimate library search locations, then invokes any oneDNN-dependent binary; the application loads the attacker library, executing code that escalates privileges.

How to fix it

Upgrade Intel oneAPI Deep Neural Network (oneDNN) to version 2022.1 or later on all affected systems; where an immediate upgrade is not feasible, restrict write access to directories in the DLL search path and run oneDNN workloads under the lowest practical privilege level.

How to confirm the fix worked

Inventory all installations of oneDNN and confirm the version string is 2022.1 or newer; re-execute representative workloads after the update and verify that only signed libraries from the expected Intel directories are loaded.

Typical attack path

1. Obtain local authenticated access to a target system
2. Identify a writable directory in the oneDNN DLL search order
3. Drop a malicious library with a name matching an expected oneDNN dependency
4. Trigger execution of any oneDNN-linked application or service
5. Execute attacker code with elevated privileges

How to detect it

Review process-creation and image-load events for oneDNN-linked binaries; look for unexpected DLLs loaded from user-writable paths or from directories outside the standard Intel oneAPI installation locations.

What your security team should do

• Prioritize upgrade of oneDNN to 2022.1+ on all developer and CI systems that perform deep-learning builds or inference
• Add oneDNN version checks to software bill-of-materials and dependency scanners
• Harden DLL search paths via application manifests or Safe DLL Search Mode where supported
• Monitor for anomalous library loads or unexpected privilege changes on hosts that run oneDNN