CVE-2024-33617: Intel QAT Engine Information Disclosure Flaw

CVE-2024-33617 Overview

CVE-2024-33617 is an information disclosure vulnerability in the Intel QuickAssist Technology (QAT) Engine for OpenSSL software before version v1.6.1. The flaw stems from insufficient control flow management (CWE-691) in the cryptographic engine that offloads OpenSSL operations to Intel QAT hardware accelerators. A remote unauthenticated attacker with network access to a service using the vulnerable engine can potentially extract sensitive information processed by the affected cryptographic routines.

Critical Impact
Remote, unauthenticated attackers may obtain confidential data processed by OpenSSL implementations backed by the Intel QAT Engine, undermining confidentiality of TLS sessions and other cryptographic operations.

Affected Products

Intel QAT Engine for OpenSSL software versions prior to v1.6.1
Deployments of OpenSSL that load the Intel QAT Engine for hardware-accelerated cryptography
Systems using Intel QuickAssist Technology accelerators for TLS, IPsec, or compression offload

Discovery Timeline

2024-11-13 - CVE-2024-33617 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-33617

Vulnerability Analysis

The Intel QAT Engine for OpenSSL is a shared library that redirects OpenSSL cryptographic operations, including RSA, ECDSA, AES-GCM, and ChaCha20-Poly1305, to Intel QuickAssist Technology hardware. The affected versions contain insufficient control flow management, meaning execution paths in the engine do not consistently enforce expected state transitions or validation checkpoints during cryptographic processing.

When the engine handles requests over a network-exposed service such as an HTTPS or IPsec endpoint, an attacker can craft inputs that steer processing into states which leak internal data. The disclosed information may include memory contents adjacent to cryptographic buffers or intermediate values from key operations.

According to EPSS data as of 2026-09-22, the vulnerability carries a probability of 0.455% with a percentile ranking of 38.864, indicating limited observed exploitation attempts. Attack complexity is high because successful exploitation requires meeting specific timing or protocol conditions in the QAT offload path.

Root Cause

The root cause is classified under [CWE-691] Insufficient Control Flow Management. Code paths in the pre-v1.6.1 engine fail to fully constrain execution when handling certain inputs, allowing sensitive intermediate cryptographic state to be observable through the network-facing protocol.

Attack Vector

Exploitation occurs over the network without authentication or user interaction. An attacker interacts with a service performing cryptographic operations through the vulnerable QAT engine and observes protocol responses to infer confidential data. No public proof-of-concept exploit is available, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog.

No verified exploitation code is available. Refer to the Intel Security Advisory SA-01177 for authoritative technical details.

Detection Methods for CVE-2024-33617

Indicators of Compromise

Presence of Intel QAT Engine shared libraries (qatengine.so) at versions below v1.6.1 on hosts running OpenSSL-based services
OpenSSL configuration files referencing the qat or qatengine engine identifier on systems with unpatched QAT Engine packages
Anomalous volumes of repeated TLS handshakes or cryptographic operations from a single remote source targeting QAT-accelerated services

Detection Strategies

Inventory all hosts with Intel QuickAssist Technology accelerators and query installed QAT Engine package versions against v1.6.1
Query OpenSSL runtime configuration (openssl engine -t -c qatengine) across the fleet to identify systems actively loading the affected engine
Correlate network telemetry with cryptographic service logs to identify unusual probing of TLS or IPsec endpoints backed by QAT hardware

Monitoring Recommendations

Alert on unexpected changes to OpenSSL engine configuration files under /etc/ssl/ or vendor-specific paths
Track TLS error rates and handshake anomalies on services offloading crypto to QAT, which may indicate probing attempts
Ingest package management and file integrity events into a centralized data lake to detect the presence of vulnerable library versions across the environment

How to Mitigate CVE-2024-33617

Immediate Actions Required

Upgrade the Intel QAT Engine for OpenSSL to version v1.6.1 or later on all affected systems
Restart every OpenSSL-linked service after upgrading so the patched engine is loaded into memory
Restrict network exposure of services that rely on QAT-accelerated cryptography to trusted networks until patching completes

Patch Information

Intel published remediation guidance in Intel Security Advisory SA-01177. Administrators must update the Intel QAT Engine for OpenSSL to v1.6.1 or later. Verify the fix by inspecting the installed version string and confirming that the loaded engine matches the patched release.

Workarounds

Disable the QAT engine in OpenSSL configuration and fall back to software cryptography where hardware acceleration is not essential
Front-end vulnerable services with a patched TLS-terminating proxy that does not use the affected engine
Apply network segmentation and access control lists to limit which clients can reach QAT-accelerated endpoints until the upgrade is complete

bash

# Verify installed QAT Engine version and disable it if patching is delayed
openssl engine -t -c qatengine
# In openssl.cnf, comment out the engine section to fall back to software crypto:
# [openssl_init]
# engines = engine_section
# [engine_section]
# qat = qat_section