Intel oneAPI Math Kernel Library < 2025.2.0 DoS

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(277102);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/27");

  script_cve_id("CVE-2025-31948");
  script_xref(name:"IAVA", value:"2025-A-0862");

  script_name(english:"Intel oneAPI Math Kernel Library < 2025.2.0 DoS");

  script_set_attribute(attribute:"synopsis", value:
"The remote Windows host contains a library that is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"A DoS vulnerability exists in Intel oneAPI Math Kernel Library versions prior to 2025.2. Improper input validation for some Intel(R) oneAPI Math Kernel Library before version 2025.2 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. 

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01366.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f6f8ca9f");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Intel oneAPI Math Kernel Library to 2025.2 or later.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:H/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-31948");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/11/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/11/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/12/03");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:intel:oneapi_base_toolkit");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("intel_oneapi_base_toolkit_win_installed.nbin");
  script_require_keys("installed_sw/oneAPI Base Toolkit");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'oneAPI Base Toolkit', 'type': 'app'},
      'requires': [{'scope': 'target', 'match': {'os': 'windows'}}],
      'check_algorithm': 'default',
      'constraints': [
        {
          'requires': [{'scope': 'install', 'less': {'Math Kernel Library': '2025.2'}}],
          'fixed_display': 'Math Kernel Library: 2025.2'
        }
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:result);