PT-2024-8840 · Intel+1 · Intel Qat Engine For Openssl+1
CVSS v4.0
8.2
High
| Vector | AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions:
Intel(R) QAT Engine for OpenSSL versions prior to v1.6.1
Description:
The issue is related to an observable timing discrepancy in the Intel(R) QAT Engine for OpenSSL software, which may allow information disclosure via network access. This discrepancy can be exploited by manipulating an unknown input, leading to a timing discrepancy vulnerability. The exploitation of this issue can enable an attacker to disclose protected information.
Recommendations:
For versions prior to v1.6.1, update to version v1.6.1 or later to resolve the issue. As a temporary workaround, consider restricting network access to the Intel(R) QAT Engine for OpenSSL software until a patch is applied.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Intel Qat Engine For Openssl
Suse