Intel® QAT Advisory

Summary:

A potential security vulnerability in the Intel® QuickAssist Technology (QAT) software for linux may allow escalation of privilege and denial of service. Intel is releasing firmware updates to mitigate this potential vulnerability.

Vulnerability Details:

CVEID: CVE-2023-32641

Description: Improper input validation in firmware for Intel® QAT before version QAT20.L.1.0.40-00004 may allow escalation of privilege and denial of service via adjacent access.

CVSS Base Score: 7.3 High

CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H

Affected Products:

Intel® QAT Software for linux before version QAT20.L.1.0.40-00004.

Recommendation:

Intel recommends updating Intel® QAT software for linux to version QAT20.L.1.0.40-00004 or later.

Updates are available for download at this location:
<https://www.intel.com/content/www/us/en/download/765501/intel-quickassist-technology-driver-for-linux-hw-version-2-0.html&gt;

Acknowledgements:

This issue was found internally by Intel employees.

Intel, and nearly the entire technology industry, follows a disclosure practice called Coordinated Disclosure, under which a cybersecurity vulnerability is generally publicly disclosed only after mitigations are available.