LiveActive security incident?Get immediate response
CVE Record

CVE-2023-54325: crypto: qat - fix out-of-bounds read

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix out-of-bounds read When preparing an AER-CTR request, the driver copies the key provided by the user into a data structure that is accessible by the firmware. If the target device is QAT GEN4, the key size is rounded up by 16 since a rounded up size is expected by the device. If the key size is rounded up before the copy, the size used for copying the key might be bigger than the size of the region containing the key, causing an out-of-bounds read. Fix by doing the copy first and then update the keylen. This is to fix the following warning reported by KASAN: [ 138.150574] BUG: KASAN: global-out-of-bounds in qat_alg_skcipher_init_com.isra.0+0x197/0x250 [intel_qat] [ 138.150641] Read of size 32 at addr ffffffff88c402c0 by task cryptomgr_test/2340 [ 138.150651] CPU: 15 PID: 2340 Comm: cryptomgr_test Not tainted 6.2.0-rc1+ #45 [ 138.150659] Hardware name: Intel Corporation ArcherCity/ArcherCity, BIOS EGSDCRB1.86B.0087.D13.2208261706 08/26/2022 [ 138.150663] Call Trace: [ 138.150668] <TASK> [ 138.150922] kasan_check_range+0x13a/0x1c0 [ 138.150931] memcpy+0x1f/0x60 [ 138.150940] qat_alg_skcipher_init_com.isra.0+0x197/0x250 [intel_qat] [ 138.151006] qat_alg_skcipher_init_sessions+0xc1/0x240 [intel_qat] [ 138.151073] crypto_skcipher_setkey+0x82/0x160 [ 138.151085] ? prepare_keybuf+0xa2/0xd0 [ 138.151095] test_skcipher_vec_cfg+0x2b8/0x800

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue affects Intel QAT crypto acceleration handling. A key length calculation could make the driver read beyond the provided key buffer before sending data to firmware. The public bundle does not prove remote exploitability or active abuse.

Executive priority

Treat as a targeted kernel maintenance issue, not an emergency internet-wide event. Prioritize servers with Intel QAT acceleration, especially where kernel updates lag.

Technical view

In the intel_qat driver, AER-CTR request preparation for QAT GEN4 rounded key length before copying the user-provided key. That could make memcpy read past the key region. The kernel fix copies first, then updates keylen.

Likely exposure

Likely limited to Linux systems using the Intel QAT driver with QAT GEN4 devices and affected kernel versions identified by Linux. Systems without this hardware or driver path are less likely exposed.

Exploitation context

The bundle shows a KASAN global out-of-bounds read warning during kernel crypto testing. It does not cite public exploitation, CISA KEV listing, exploit code, or confirmed real-world attacks.

Researcher notes

Evidence is strongest for the root cause and fix, but weak for impact breadth. The bundle gives no CVSS, CWE, exploitability analysis, or affected distribution mapping.

Mitigation direction

  • Apply a Linux kernel update containing the referenced stable fixes.
  • Follow your distribution vendor advisory for the corrected kernel package.
  • Prioritize systems using Intel QAT GEN4 crypto acceleration.
  • If patching is delayed, seek vendor guidance on QAT risk reduction.

Validation and detection

  • Inventory Linux kernel versions on systems with Intel QAT hardware.
  • Check whether the intel_qat driver is loaded or packaged.
  • Confirm the relevant stable kernel fix is present in deployed builds.
  • Review kernel logs for QAT or KASAN out-of-bounds read warnings.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-54325 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux67916c9516893528ecce060ada1f58af0ce33d93, 67916c9516893528ecce060ada1f58af0ce33d93, 67916c9516893528ecce060ada1f58af0ce33d93, 67916c9516893528ecce060ada1f58af0ce33d93unaffected
LinuxLinux5.11, 0, 5.15.99, 6.1.16, 6.2.3, 6.3affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.