CVE-2023-54325: crypto: qat - fix out-of-bounds read
In the Linux kernel, the following vulnerability has been resolved:
crypto: qat - fix out-of-bounds read
When preparing an AER-CTR request, the driver copies the key provided by the user into a data structure that is accessible by the firmware. If the target device is QAT GEN4, the key size is rounded up by 16 since a rounded up size is expected by the device. If the key size is rounded up before the copy, the size used for copying the key might be bigger than the size of the region containing the key, causing an out-of-bounds read.
Fix by doing the copy first and then update the keylen.
This is to fix the following warning reported by KASAN:
[ 138.150574] BUG: KASAN: global-out-of-bounds in qatalgskcipherinitcom.isra.0+0x197/0x250 [intelqat] [ 138.150641] Read of size 32 at addr ffffffff88c402c0 by task cryptomgrtest/2340
[ 138.150651] CPU: 15 PID: 2340 Comm: cryptomgrtest Not tainted 6.2.0-rc1+ #45 [ 138.150659] Hardware name: Intel Corporation ArcherCity/ArcherCity, BIOS EGSDCRB1.86B.0087.D13.2208261706 08/26/2022 [ 138.150663] Call Trace: [ 138.150668] <TASK> [ 138.150922] kasancheckrange+0x13a/0x1c0 [ 138.150931] memcpy+0x1f/0x60 [ 138.150940] qatalgskcipherinitcom.isra.0+0x197/0x250 [intelqat] [ 138.151006] qatalgskcipherinitsessions+0xc1/0x240 [intelqat] [ 138.151073] cryptoskciphersetkey+0x82/0x160 [ 138.151085] ? preparekeybuf+0xa2/0xd0 [ 138.151095] testskcipherveccfg+0x2b8/0x800
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In the intel_qat crypto code path (function prepare_keybuf / qat_alg_skcipher_init_com), copy the provided key using the original (non-rounded-up) key size first, and only then update the keylen field after the copy. This prevents the driver from rounding the key size before memcpy, which can cause an out-of-bounds read reported by KASAN in qat_alg_skcipher_init_com (intel_qat).
Linux kernel intel_qat driver prepare_keybuf key copy order = Copy first, then update keylen - Configuration
For QAT GEN4 devices, ensure the key size is rounded up by 16 only after copying the original key buffer (do not round up before the copy). The material notes that QAT GEN4 expects a rounded up size by 16, and the bug occurs when the rounded-up size is used for copying.
Linux kernel intel_qat driver (QAT GEN4) key size rounding behavior = If target device is QAT GEN4, round key size up by 16 after copying (not before)
Event History
Frequently Asked Questions
What is the severity of CVE-2023-54325?
The severity of CVE-2023-54325 is classified as high due to the potential for out-of-bounds read vulnerabilities in the Linux kernel.
How do I fix CVE-2023-54325?
To fix CVE-2023-54325, update the Linux kernel to version 6.2.0-rc2 or later, which includes the patch for this vulnerability.
Which versions of the Linux kernel are affected by CVE-2023-54325?
CVE-2023-54325 affects Linux kernel version 6.2.0-rc1.
What impact does CVE-2023-54325 have on system security?
CVE-2023-54325 may allow attackers to exploit out-of-bounds reads, which can lead to information disclosure or other security issues.
Is there a known exploit for CVE-2023-54325?
As of now, there are no known public exploits for CVE-2023-54325, but it is important to ensure systems are patched to mitigate potential risks.