SB2025111446 - Multiple vulnerabilities in Intel QAT Software Drivers

Description

This security bulletin contains information about 10 secuirty vulnerabilities.

1) Input validation error (CVE-ID: CVE-2025-33000)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insufficient validation of user-supplied input. A local user can pass specially crafted input to the application and gain elevated privileges on the target system.

2) Out-of-bounds write (CVE-ID: CVE-2025-27713)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when processing untrusted input. A loal user can trigger an out-of-bounds write and gain elevated privileges on the target system.

3) Buffer overflow (CVE-ID: CVE-2025-32732)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error. A local user can trigger memory corruption and cause a denial of service condition on the target system.

4) Buffer overflow (CVE-ID: CVE-2025-24519)

The vulnerability allows a local user to compromise the target system.

The vulnerability exists due to a boundary error. A local user can trigger memory corruption and manipulate data on the target system.

5) Untrusted Pointer Dereference (CVE-ID: CVE-2025-32446)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to untrusted pointer dereference. A local user can manipulate data on the target system.

6) Untrusted Pointer Dereference (CVE-ID: CVE-2025-27710)

The vulnerability allows a local user to gain access to sensitive information on the system.

The vulnerability exists due to untrusted pointer dereference. A local user can enable data exposure.

7) Out-of-bounds read (CVE-ID: CVE-2025-31937)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition. A local user can trigger an out-of-bounds read error and cause a denial of service condition on the system.

8) NULL pointer dereference (CVE-ID: CVE-2025-26694)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A local user can pass specially crafted data to the application and perform a denial of service (DoS) attack.

9) Input validation error (CVE-ID: CVE-2025-30509)

The vulnerability allows a local user to compromise the target system.

The vulnerability exists due to insufficient validation of user-supplied input. A local user can pass specially crafted input to the application and manipulate the data on system.

10) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2025-32088)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper conditions check. A local user can pass specially crafted input to the application and cause a denial of service condition on system.

Remediation

Install update from vendor's website.

References

• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01373.html