Insufficient control flow management in QuickAssist Technology (QAT) Engine for OpenSSL - CVE-2024-33617

Vulnerability identifier: #VU101953

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-33617

CWE-ID: CWE-691

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient control flow management. A remote attacker can obtain sensitive information.

QuickAssist Technology (QAT) Engine for OpenSSL
SUSE Linux Enterprise Server 15 SP5
SUSE Manager Server 4.3
SUSE Manager Retail Branch Server 4.3
SUSE Manager Proxy 4.3
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
Basesystem Module
openSUSE Leap
qatzip-debugsource
libqatzip3
qatzip
libqatzip3-debuginfo
qatzip-debuginfo
qatzip-devel
qatengine
qatengine-debuginfo
qatengine-debugsource
qatlib
libqat4
libqat4-debuginfo
libusdm0-debuginfo
qatlib-debuginfo
libusdm0
qatlib-debugsource
qatlib-devel

Install updates from vendor's website.

QuickAssist Technology (QAT) Engine for OpenSSL - update to 1.6.1
qatzip-debugsource - addressed in versions 1.1.0-150400.3.3.1, 1.1.0-150500.3.2.1
libqatzip3 - addressed in versions 1.1.0-150400.3.3.1, 1.1.0-150500.3.2.1
qatzip - addressed in versions 1.1.0-150400.3.3.1, 1.1.0-150500.3.2.1
libqatzip3-debuginfo - addressed in versions 1.1.0-150400.3.3.1, 1.1.0-150500.3.2.1
qatzip-debuginfo - addressed in versions 1.1.0-150400.3.3.1, 1.1.0-150500.3.2.1
qatzip-devel - addressed in versions 1.1.0-150400.3.3.1, 1.1.0-150500.3.2.1
qatengine - addressed in versions 1.7.0-150400.3.6.1, 1.7.0-150500.3.3.1, 1.7.0-150600.3.3.1
qatengine-debuginfo - addressed in versions 1.7.0-150400.3.6.1, 1.7.0-150500.3.3.1, 1.7.0-150600.3.3.1
qatengine-debugsource - addressed in versions 1.7.0-150400.3.6.1, 1.7.0-150500.3.3.1, 1.7.0-150600.3.3.1
qatlib - addressed in versions 24.09.0-150400.3.6.1, 24.09.0-150500.3.3.1, 24.09.0-150600.3.3.1
libqat4 - addressed in versions 24.09.0-150400.3.6.1, 24.09.0-150500.3.3.1, 24.09.0-150600.3.3.1
libqat4-debuginfo - addressed in versions 24.09.0-150400.3.6.1, 24.09.0-150500.3.3.1, 24.09.0-150600.3.3.1
libusdm0-debuginfo - addressed in versions 24.09.0-150400.3.6.1, 24.09.0-150500.3.3.1, 24.09.0-150600.3.3.1
qatlib-debuginfo - addressed in versions 24.09.0-150400.3.6.1, 24.09.0-150500.3.3.1, 24.09.0-150600.3.3.1
libusdm0 - addressed in versions 24.09.0-150400.3.6.1, 24.09.0-150500.3.3.1, 24.09.0-150600.3.3.1
qatlib-debugsource - addressed in versions 24.09.0-150400.3.6.1, 24.09.0-150500.3.3.1, 24.09.0-150600.3.3.1
qatlib-devel - addressed in versions 24.09.0-150400.3.6.1, 24.09.0-150500.3.3.1, 24.09.0-150600.3.3.1

• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01177.html

• Multiple vulnerabilities in Intel QuickAssist Technology Engine for OpenSSL
• SUSE update for qatengine, qatlib
• SUSE update for qatengine, qatlib
• SUSE update for qatengine, qatlib