Out-of-Bounds Read Vulnerability in Intel QAT Driver for Linux Kernel

CVE-2023-54325

What is CVE-2023-54325?

A vulnerability in the Intel QuickAssist Technology (QAT) driver for the Linux kernel allows for an out-of-bounds read when handling AER-CTR requests. The issue arises during the key copying process, where the driver incorrectly rounds the key size before completing the copy operation. If the key size is overshot, it may attempt to read memory outside the allocated area, potentially enabling unauthorized access to sensitive data. This flaw has been rectified to ensure key length is correctly determined after the copy process to mitigate the associated risks.

References