CVE-2023-35003 is a path traversal flaw in Intel Virtual RAID on CPU (VROC) software, scored 6.7 Medium. An authenticated local user may escalate privileges. Intel says versions before 8.0.8.1001 are affected, and recommends installing the update from your system manufacturer.
What's affected
Intel's advisory INTEL-SA-00953 covers Intel VROC software before version 8.0.8.1001. The fixed version is 8.0.8.1001. The same advisory covers CVE-2023-31271, CVE-2023-32646, CVE-2023-34315 and CVE-2023-35003, each scored 6.7 Medium with the vector CVSS:3.1/AV:L/AC:H/PR:L/UI:R, so the record and Intel agree on severity.
The impact is escalation of privilege for an authenticated user with local access. It is not a remote flaw. Intel recommends updating to the latest version provided by the system manufacturer, which means the package may come from your server or workstation vendor rather than directly from Intel.
How to check if you're exposed
Find the installed Intel VROC version on each server or workstation that uses VROC for RAID. On Windows, check the installed programs list. On Linux, VROC is typically managed through mdadm and related packages, so use your package manager and the vendor's tooling to read the version. Anything before 8.0.8.1001 is in scope.
Because the software often ships through the hardware vendor, also check your server vendor's support page for a firmware or driver bundle that includes VROC 8.0.8.1001 or later.
What to do now
- Inventory machines that use Intel VROC and record the installed version.
- Get the update to 8.0.8.1001 or later from your system manufacturer, as Intel recommends.
- Test the update on a non-production machine first, because storage drivers touch boot and data volumes.
- Until patched, limit local and remote shell access on affected machines to the people who need it.
- Add the version to your asset list for the next advisory.
Why it matters
Path traversal happens when a program builds a file path from input and does not stop the input from stepping outside the intended folder. A user with limited rights can then reach or place files in locations they should not touch.
In a privileged component, that can turn into escalation, which is how Intel describes the impact here. The score is medium because the attacker needs a local account and the attack is rated complex. Still, local accounts are common on shared machines.
The weakness classes involved are CWE-249 (Path Manipulation), CWE-22 (Path Traversal). The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and none of the advisories I read says it is exploited in the wild. That can change, so treat the status as a snapshot.
Intel and NVD agree on 6.7 Medium for this CVE. Intel lists the fixed version as 8.0.8.1001, and the record's description matches.
Quick check
Is this the same bug as CVE-2023-34315?
No. Intel lists them as separate CVEs in the same advisory, with different weakness types, though all are fixed in 8.0.8.1001.
Is this remotely exploitable?
No. The vector is local and the attacker must be an authenticated user, per Intel.
Sources
Last reviewed: 19 October 2026.
