CVE-2024-53162

What it actually does

Off-by-one error in uof_get_name() allows out-of-bounds read when accessing fw_objs[] array beyond its num_objs elements.

Why it matters to the business

Potential exposure of kernel memory contents on affected Linux systems could lead to information leaks or aid further attacks, increasing risk for systems running vulnerable crypto drivers.

How an attack unfolds

An attacker with local access crafts input that triggers the faulty boundary check in the qat_4xxx driver, causing an out-of-bounds read that may leak kernel memory; listed threat actors have targeted similar Linux kernel out-of-bounds issues in espionage and financial campaigns.

How to fix it

Update to fixed kernel versions that correct the boundary check in crypto/qat/qat_4xxx; apply vendor patches for affected distributions.

How to confirm the fix worked

Confirm kernel version includes the resolved uof_get_name() check; inspect source for >= comparison on num_objs and test with boundary input.

Typical attack path

1. Obtain local code execution on target Linux system
2. Load or interact with qat_4xxx crypto module to reach uof_get_name()
3. Supply malformed firmware object data to exceed array bounds
4. Read leaked kernel memory to gather credentials or addresses for escalation

How to detect it

Review kernel logs and audit trails for unusual crypto driver accesses or memory-related faults around qat module activity; correlate with process execution of tools that interact with QAT hardware.

What your security team should do

• Prioritize kernel updates on systems using Intel QAT 4xxx hardware
• Monitor for local privilege escalation attempts following memory disclosure
• Restrict unprivileged local access where possible until patched