CVE-2023-38197
📋 TL;DR
This vulnerability in Qt's XML parsing allows attackers to cause denial of service through infinite loops during recursive entity expansion. It affects applications using Qt's XML processing functionality before patched versions, potentially causing resource exhaustion and application crashes.
💻 Affected Systems
- Qt
- Applications using Qt XML processing
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service with application crashes and resource exhaustion, potentially affecting availability of services using Qt XML processing.
Likely Case
Application hangs or crashes when processing malicious XML input, leading to service disruption.
If Mitigated
Limited impact with proper input validation and resource limits, though still potentially disruptive.
🎯 Exploit Status
Exploitation requires sending malicious XML to applications using Qt's XML parser. No public exploit code identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Qt 5.15.15, 6.2.10, 6.5.3 or later
Vendor Advisory: https://codereview.qt-project.org/c/qt/qtbase/+/488960
Restart Required: Yes
Instructions:
1. Update Qt to patched version (5.15.15+, 6.2.10+, or 6.5.3+). 2. Recompile applications with updated Qt libraries. 3. Restart affected services.
🔧 Temporary Workarounds
XML Input Validation
allImplement strict validation and size limits on XML input to prevent recursive entity expansion attacks.
Resource Limits
linuxConfigure system resource limits (CPU time, memory) for applications processing XML to mitigate DoS impact.
ulimit -t 30
ulimit -m 1048576
🧯 If You Can't Patch
- Implement network-level filtering to block or limit XML input to vulnerable applications
- Deploy application-level monitoring for abnormal resource consumption patterns
🔍 How to Verify
Check if Vulnerable:
Check Qt version: qmake --version or examine Qt library files. Verify if version falls within affected ranges.Check Version:
qmake --versionVerify Fix Applied:
Confirm Qt version is 5.15.15+, 6.2.10+, or 6.5.3+ after update.📡 Detection & Monitoring
Log Indicators:
- Application crashes or hangs
- High CPU usage spikes
- Memory exhaustion warnings
Network Indicators:
- Unusually large XML payloads
- Repeated XML requests to same endpoint
SIEM Query:
source="application.log" AND ("crash" OR "hang" OR "high cpu") AND process="*qt*"🔗 References
- https://codereview.qt-project.org/c/qt/qtbase/+/488960
- https://lists.debian.org/debian-lts-announce/2023/08/msg00028.html
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F5C3NYVJ73ITE6HUOVVHBUAGORVEJRHO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XEGQ6DFTL2BEJMHCD5FJGI6XLWQI7UEA/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFZORZYCMUZZFIOEZICJ7VH2BZIGY3HV/
- https://codereview.qt-project.org/c/qt/qtbase/+/488960
- https://lists.debian.org/debian-lts-announce/2023/08/msg00028.html
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F5C3NYVJ73ITE6HUOVVHBUAGORVEJRHO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XEGQ6DFTL2BEJMHCD5FJGI6XLWQI7UEA/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFZORZYCMUZZFIOEZICJ7VH2BZIGY3HV/
