Buffer overflow in QuickAssist Technology (QAT) Engine for OpenSSL - CVE-2022-43507

Vulnerability identifier: #VU79518

CSH Severity: Medium

CVSS v4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-43507

CWE-ID: CWE-120

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to compromise the affected system.

The vulnerability exists due to a boundary error. A remote user can pass specially crafted data to the application and execute arbitrary code.

QuickAssist Technology (QAT) Engine for OpenSSL
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
Basesystem Module
openSUSE Leap
qatengine-debugsource
qatengine
qatengine-debuginfo

Install updates from vendor's website.

QuickAssist Technology (QAT) Engine for OpenSSL - update to 0.6.16
qatengine-debugsource - update to 0.6.10-150400.3.3.1
qatengine - update to 0.6.10-150400.3.3.1
qatengine-debuginfo - update to 0.6.10-150400.3.3.1

• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00798.html

• Arbitrary code execution in Intel QAT Engine for OpenSSL
• SUSE update for qatengine