Login Sign Up

CVE-2023-24607

7.5 HIGH
Denial of Service Buffer Overflow

📋 TL;DR

This vulnerability in Qt's SQL ODBC driver allows denial of service via a crafted string when SQLTCHAR size is 4. It affects applications using Qt's database connectivity with ODBC drivers. Users of Qt 5.x before 5.15.13, 6.x before 6.2.8, and 6.3.x before 6.4.3 are vulnerable.

💻 Affected Systems

Products:
  • Qt Framework
  • Applications using Qt SQL ODBC driver
Versions: Qt 5.x before 5.15.13, Qt 6.x before 6.2.8, Qt 6.3.x before 6.4.3
Operating Systems: All platforms supporting Qt
Default Config Vulnerable: ✅ No
Notes: Only vulnerable when using SQL ODBC driver with SQLTCHAR size of 4 (typically Windows ODBC).

📦 What is this software?

Qt by Qt

View all CVEs affecting Qt →

Qt by Qt

View all CVEs affecting Qt →

Qt by Qt

View all CVEs affecting Qt →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete application crash leading to service unavailability for applications using Qt's ODBC database connectivity.

🟠

Likely Case

Application instability and crashes when processing malicious database input through ODBC connections.

🟢

If Mitigated

Minimal impact if ODBC driver is not used or if input validation prevents malicious strings.

🌐 Internet-Facing: MEDIUM - Applications exposed to untrusted database input via ODBC could be targeted.
🏢 Internal Only: LOW - Requires specific ODBC configuration and malicious database input.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ✅ No
Complexity: MEDIUM

Requires ability to inject crafted strings into ODBC database queries. No public exploit code available.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Qt 5.15.13, Qt 6.2.8, Qt 6.4.3 or later

Vendor Advisory: https://codereview.qt-project.org/c/qt/qtbase/+/456216

Restart Required: Yes

Instructions:

1. Update Qt to patched version. 2. Recompile applications with updated Qt libraries. 3. Restart affected services.

🔧 Temporary Workarounds

Disable ODBC driver

all

Remove or disable Qt's SQL ODBC driver plugin if not required

rm /path/to/qt/plugins/sqldrivers/libqsqlodbc.so
rm /path/to/qt/plugins/sqldrivers/qsqlodbc.dll

Use alternative SQL driver

all

Switch to SQLite, PostgreSQL, or MySQL drivers instead of ODBC

🧯 If You Can't Patch

  • Implement strict input validation for all database queries using ODBC
  • Deploy application-level rate limiting and monitoring for abnormal ODBC query patterns

🔍 How to Verify

Check if Vulnerable:

Check Qt version and verify ODBC driver usage in application configuration

Check Version:

qmake --version

Verify Fix Applied:

Verify Qt version is 5.15.13+, 6.2.8+, or 6.4.3+ and test ODBC connectivity

📡 Detection & Monitoring

Log Indicators:

  • Application crashes with Qt SQL ODBC driver
  • Abnormal termination of Qt database processes

Network Indicators:

  • Unusual ODBC connection patterns
  • Repeated database connection failures

SIEM Query:

source="application.log" AND "qt" AND "odbc" AND ("crash" OR "segfault" OR "terminated")

📊 Metadata

CVE ID: CVE-2023-24607
CVSS v3 Score: 7.5 (HIGH)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: April 15, 2023
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON