Bug 1993136 (CVE-2020-24742)

Summary:	CVE-2020-24742 qt: QPluginLoader loads plugins relative to CWD which could result in arbitrary code execution
Product:	[Other] Security Response	Reporter:	Michael Kaplan <mkaplan>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	helio, jgrulich, jreznik, kasal, kevin, me, rdieter, smparrish, than
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	qt 5.12.7, qt 5.14.0	Doc Type:	If docs needed, set a value
Doc Text:	Qt5 versions up to qt 5.12.7, qt 5.14.1, qt 5.15.0 allows plugins to be loaded from current working directory, this can lead to compromised plugins to loaded leading to possible arbitrary code execution.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-11-19 14:38:08 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1993137, 1993138, 1993139, 2011866, 2011867
Bug Blocks:	1993141

Description Michael Kaplan 2021-08-12 13:10:30 UTC

An issue has been fixed in Qt versions 5.14.0 where QPluginLoader attempts to load plugins relative to the working directory, allowing attackers to execute arbitrary code via crafted files.

Reference:

https://codereview.qt-project.org/c/qt/qtbase/+/280730

Comment 1 Michael Kaplan 2021-08-12 13:11:03 UTC

Created qt tracking bugs for this issue:

Affects: fedora-all [bug 1993139]


Created qt3 tracking bugs for this issue:

Affects: fedora-all [bug 1993137]


Created qt5 tracking bugs for this issue:

Affects: fedora-all [bug 1993138]

Comment 2 Tomas Hoger 2021-08-12 14:30:49 UTC

Upstream commit:

https://codereview.qt-project.org/gitweb?p=qt/qtbase.git;a=commitdiff;h=bf131e8d2181b3404f5293546ed390999f760404

It seems the problematic code was introduced via the following commit in version 5.6.0:

https://codereview.qt-project.org/gitweb?p=qt/qtbase.git;a=commitdiff;h=3146dadb42cb36aff83a62e831b8b4f4dc1562a7

Comment 4 Marco Benatto 2021-10-11 13:08:24 UTC

Currently qt5 from versions 5.6.0 up to 5.12.7 and 5.14.0 allows plugins to be loaded from CWD. This may lead to arbitrary code execution, as QT plugin manager may eventually load a compromised plugin maliciously placed into CWD by an attacker instead a legit one.