CVE-2023-54325
Out-of-Bounds Read in Linux Kernel QAT Crypto Driver
Publication date: 2025-12-30
Last updated on: 2025-12-30
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| intel | qat | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an out-of-bounds read in the Linux kernel's Intel QAT (QuickAssist Technology) driver. When preparing an AER-CTR request, the driver copies a user-provided key into a data structure accessible by the firmware. For QAT GEN4 devices, the key size is rounded up by 16 bytes before copying, but if this rounding happens before the copy, the copy operation may read beyond the actual key size, causing an out-of-bounds read. The fix involves copying the key first and then updating the key length to prevent reading outside the allocated memory.
How can this vulnerability impact me? :
This vulnerability can lead to an out-of-bounds read in kernel memory, which may cause system instability, crashes, or potentially expose sensitive information from adjacent memory areas. Since it involves reading beyond the intended memory region, it could be exploited to leak data or cause denial of service in systems using the affected Intel QAT driver.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring kernel logs for KASAN (Kernel Address Sanitizer) warnings related to the intel_qat driver, specifically messages indicating out-of-bounds reads such as 'BUG: KASAN: global-out-of-bounds in qat_alg_skcipher_init_com'. You can check the kernel log using commands like 'dmesg | grep -i qat' or 'journalctl -k | grep -i qat' to look for such warnings.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the Linux kernel to a version where this vulnerability is fixed, as the issue is resolved by changing the order of copying and updating the key length in the intel_qat driver. Until an update is applied, avoid using the affected QAT GEN4 device features that trigger the vulnerability if possible.