CVE-2023-51714
📋 TL;DR
This vulnerability is an integer overflow in the HPack table implementation of Qt's HTTP/2 component. It allows remote attackers to cause a denial of service (crash) or potentially execute arbitrary code by sending specially crafted HTTP/2 requests. Applications using Qt's networking stack with HTTP/2 enabled are affected.
💻 Affected Systems
- Qt applications using QtNetwork module with HTTP/2 support
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise of the Qt application process.
Likely Case
Denial of service through application crash or instability.
If Mitigated
Limited impact if HTTP/2 is disabled or network access is restricted.
🎯 Exploit Status
Exploitation requires sending specially crafted HTTP/2 requests but no public exploit code is available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Qt 5.15.17, 6.2.11, 6.5.4, 6.6.2 or later
Vendor Advisory: https://codereview.qt-project.org/c/qt/qtbase/+/524864
Restart Required: Yes
Instructions:
1. Identify Qt version in use. 2. Update to patched version via package manager or Qt installer. 3. Recompile applications if using static linking. 4. Restart affected applications.
🔧 Temporary Workarounds
Disable HTTP/2
allDisable HTTP/2 support in Qt applications to prevent exploitation
Set QNetworkRequest::Http2AllowedAttribute to false in application code
Network filtering
allBlock or filter HTTP/2 traffic to vulnerable applications
Use firewall rules to block HTTP/2 ports (typically 443 with ALPN)
🧯 If You Can't Patch
- Disable HTTP/2 support in all Qt applications
- Implement network segmentation to isolate vulnerable applications
🔍 How to Verify
Check if Vulnerable:
Check Qt version using qmake --version or examine application dependenciesCheck Version:
qmake --versionVerify Fix Applied:
Verify Qt version is 5.15.17+, 6.2.11+, 6.5.4+, or 6.6.2+📡 Detection & Monitoring
Log Indicators:
- Application crashes or abnormal termination
- Memory access violation errors in logs
Network Indicators:
- Unusual HTTP/2 traffic patterns
- Malformed HTTP/2 requests
SIEM Query:
source="application.logs" AND ("segmentation fault" OR "access violation" OR "QtNetwork")🔗 References
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
