CVE-2023-22313: intel qat_driver_firmware

Vulnerability summary

CVE-2023-22313 is a low (CVSS 2.3) vulnerability in intel qat_driver_firmware. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 11.1% of scored vulnerabilities.

Timeline

1. 14-11-2023
   PublishedVulnerability first disclosed.
2. 02-08-2024
   Last modifiedVulnerability information updated.

Description

Improper buffer restrictions in some Intel(R) QAT Library software before version 22.07.1 may allow a privileged user to potentially enable information disclosure via local access.

• CWE-92DEPRECATED: Improper Sanitization of Custom Special CharactersThis entry has been deprecated. It originally came from PLOVER, which sometimes defined "other" and "miscellaneous" categories in order to satisfy exhaustiveness requirements for taxonomies. Within the context of CWE, the use of a more abstract entry is preferred in mapping situations. CWE-75 is a more appropriate mapping.
• CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.