CVE-2024-53163

What it actually does

Off-by-one comparison error in uof_get_name() causes out-of-bounds array access when num_objs equals the size of fw_objs[] array in the qat_420xx crypto driver.

Why it matters to the business

Memory corruption in the Linux kernel on affected systems can lead to crashes, data integrity issues, or potential privilege escalation, increasing operational risk and downtime for organizations running vulnerable kernels.

How an attack unfolds

An attacker with local access crafts conditions to invoke uof_get_name_420xx() such that the faulty bounds check allows reading or writing beyond the intended firmware object array, leveraging the memory corruption primitive.

How to fix it

Update the Linux kernel to a version containing the fix for the off-by-one check in uof_get_name(); for flashplugin-nonfree on Ubuntu 14.04 LTS upgrade to 11.2.202.626ubuntu0.14.04.1.

How to confirm the fix worked

Confirm kernel source contains the corrected >= comparison in uof_get_name() and verify the updated package version is installed via package manager.

Typical attack path

1. Obtain local execution on a system running the vulnerable qat_420xx driver
2. Trigger firmware object enumeration that hits the off-by-one path
3. Exploit resulting out-of-bounds access for memory corruption or escalation

How to detect it

Review kernel logs for oops or panic messages referencing qat or uof_get_name; inspect process execution and module loading events around firmware handling.

What your security team should do

• Prioritize kernel updates on systems using qat_420xx hardware
• Monitor for any local privilege-escalation attempts on affected hosts
• Restrict untrusted local access until patches are applied