CVE-2023-34315 is an incorrect default permissions flaw in Intel Virtual RAID on CPU (VROC) software, scored 6.7 Medium. An authenticated local user may escalate privileges. Intel says versions before 8.0.8.1001 are affected, and recommends installing the update from your system manufacturer.
What's affected
Intel's advisory INTEL-SA-00953 covers Intel VROC software before version 8.0.8.1001. The fixed version is 8.0.8.1001. The same advisory covers CVE-2023-31271, CVE-2023-32646, CVE-2023-34315 and CVE-2023-35003, each scored 6.7 Medium with the vector CVSS:3.1/AV:L/AC:H/PR:L/UI:R, so the record and Intel agree on severity.
The impact is escalation of privilege for an authenticated user with local access. It is not a remote flaw. Intel recommends updating to the latest version provided by the system manufacturer, which means the package may come from your server or workstation vendor rather than directly from Intel.
How to check if you're exposed
Find the installed Intel VROC version on each server or workstation that uses VROC for RAID. On Windows, check the installed programs list. On Linux, VROC is typically managed through mdadm and related packages, so use your package manager and the vendor's tooling to read the version. Anything before 8.0.8.1001 is in scope.
Because the software often ships through the hardware vendor, also check your server vendor's support page for a firmware or driver bundle that includes VROC 8.0.8.1001 or later.
What to do now
- Inventory machines that use Intel VROC and record the installed version.
- Get the update to 8.0.8.1001 or later from your system manufacturer, as Intel recommends.
- Test the update on a non-production machine first, because storage drivers touch boot and data volumes.
- Until patched, limit local and remote shell access on affected machines to the people who need it.
- Add the version to your asset list for the next advisory.
Why it matters
The weakness is simple: files or folders are installed with permissions that let more users change them than should. A low-privileged local user may replace or alter something that a higher privileged component later uses. That is how a small foothold becomes administrative control.
The score is medium because the attacker already needs a local account and the attack is complex. In shared servers, jump hosts and lab machines, though, local accounts are common, so patching still belongs in the normal cycle.
The weakness classes involved are CWE-276 (Incorrect Default Permissions). The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and none of the advisories I read says it is exploited in the wild. That can change, so treat the status as a snapshot.
Intel and NVD agree on 6.7 Medium for this CVE. Intel lists the fixed version as 8.0.8.1001, and the record's description matches.
Quick check
Is this remotely exploitable?
No. The vector is local and the attacker must be an authenticated user, per Intel's advisory.
Where do I get the fix?
Intel recommends the version provided by your system manufacturer. Check that vendor's download page.
Sources
Last reviewed: 19 October 2026.
