CVE-2023-43114: Qt Framework DOS Vulnerability on Windows

CVE-2023-43114 Overview

CVE-2023-43114 is a denial of service vulnerability discovered in the Qt framework affecting Windows systems. The vulnerability exists in the GDI font engine implementation, where loading a corrupted font via QFontDatabase::addApplicationFont{FromData] can cause application crashes due to missing length checks. This input validation flaw allows attackers to craft malicious font files that trigger application instability.

Critical Impact

Applications built with vulnerable Qt versions on Windows can be crashed through maliciously crafted font files, potentially leading to denial of service conditions.

Affected Products

• Qt versions before 5.15.16
• Qt versions 6.x before 6.2.10
• Qt versions 6.3.x through 6.5.x before 6.5.3 on Windows

Discovery Timeline

• 2023-09-18 - CVE-2023-43114 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-43114

Vulnerability Analysis

This vulnerability stems from insufficient input validation within the Qt framework's GDI font engine on Windows platforms. When an application utilizes the QFontDatabase::addApplicationFont or QFontDatabase::addApplicationFontFromData functions to load font data, the GDI font engine fails to properly validate the length parameters of font file structures.

The absence of proper length checks means that a corrupted or maliciously crafted font file can contain invalid length values that cause the application to read beyond allocated memory boundaries or process malformed data structures. This leads to an unhandled exception condition resulting in application termination.

The vulnerability requires local access and user interaction, as an attacker must convince a user to load the malicious font file through an application using the vulnerable Qt framework. While this limits the attack surface, applications that process untrusted font files (such as document viewers, design software, or font management utilities) are particularly at risk.

Root Cause

The root cause of CVE-2023-43114 is missing length validation checks in the GDI font engine's font parsing routines. When processing font data through QFontDatabase::addApplicationFont{FromData], the code does not adequately verify that length fields within the font file structure are valid before using them in memory operations. This improper input validation allows malformed font data to trigger undefined behavior and crashes.

Attack Vector

The attack vector for this vulnerability is local, requiring an attacker to deliver a malicious font file to the target system. Exploitation scenarios include:

1. Malicious Document Delivery: Embedding a corrupted font within a document file that an application attempts to load
2. Direct Font File Distribution: Tricking users into installing or previewing a malicious font file
3. Application Font Loading: Targeting applications that load fonts from untrusted sources or user-supplied data

When the vulnerable Qt application attempts to process the corrupted font data, the missing length checks cause the GDI font engine to process invalid data, resulting in an application crash. The vulnerability affects availability but does not allow for code execution or data exfiltration based on current analysis.

Detection Methods for CVE-2023-43114

Indicators of Compromise

• Application crashes occurring during font loading operations in Qt-based applications on Windows
• Crash dumps showing exceptions within Qt GDI font engine components
• Presence of unusually structured or malformed font files (.ttf, .otf, .woff) in application directories
• Windows Event Log entries indicating application failures related to font processing

Detection Strategies

• Monitor for repeated application crashes in Qt-based software, particularly when processing external content
• Implement file integrity monitoring for font directories and application font caches
• Deploy endpoint detection rules to identify malformed font file characteristics
• Review application logs for font loading errors or exceptions in QFontDatabase operations

Monitoring Recommendations

• Enable crash reporting and analysis for Qt-based applications in the environment
• Monitor for unusual font file activity, including downloads or creation of font files from untrusted sources
• Implement application whitelisting to control which applications can process font files
• Configure SentinelOne to monitor Qt-based application behavior for anomalous crash patterns

How to Mitigate CVE-2023-43114

Immediate Actions Required

• Update Qt framework to version 5.15.16 or later for the 5.x branch
• Update Qt framework to version 6.2.10 or later for the 6.2.x branch
• Update Qt framework to version 6.5.3 or later for the 6.3.x through 6.5.x branches
• Rebuild applications using the patched Qt libraries and deploy updated binaries
• Restrict the loading of fonts from untrusted sources until patches are applied

Patch Information

Qt has released security patches addressing this vulnerability. The fix adds proper length validation checks to the GDI font engine's font parsing routines. The patch details can be reviewed at the Qt Project Code Review. Organizations should prioritize updating to the following fixed versions:

• Qt 5.15.16 or later
• Qt 6.2.10 or later
• Qt 6.5.3 or later

Workarounds

• Disable or restrict the use of QFontDatabase::addApplicationFont and QFontDatabase::addApplicationFontFromData functions in applications until patches are applied
• Implement input validation at the application level to verify font file integrity before loading
• Use alternative font rendering engines if available within the application architecture
• Restrict application permissions to prevent loading fonts from untrusted locations