Untrusted search path in Qt - CVE-2020-0570

Vulnerability identifier: #VU24783

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-0570

CWE-ID: CWE-426

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a logic error in BIOS firmware for 8th, 9th and 10th Generation Intel(R) Core(TM) Processor. An attacker with physical access to the system can execute arbitrary code and gain unauthorized access to the system.

This vulnerability was initially reported in QLibrary from Qt for certain x86 machines searches that were performed for certain libraries and plugins relative to current working directory of the application. A local user can place files in the file system and influence the working directory of Qt-based applications to load and execute malicious code. 

Note, this vulnerability does not affect Windows systems.

Qt
10th Generation Intel Core Processors
8th Generation Intel Core Processors
Intel Pentium Processor Silver Series
9th Generation Intel Core Processors
Debian Linux
Gentoo Linux
Fedora
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
openEuler
qtbase-opensource-src (Ubuntu package)
qt5-qtbase (Red Hat package)
qt
qt-devel
qt-debuginfo
qt-debugsource
qt5-qtbase
qtbase-opensource-src (Debian package)

Install updates from vendor's website.

Qt - update to 5.14.1
qtbase-opensource-src (Ubuntu package) - addressed in versions 5.5.1+dfsg-16ubuntu7.7, 5.9.5+dfsg-0ubuntu2.5, 5.12.4+dfsg-4ubuntu1.1
qt5-qtbase (Red Hat package) - update to 5.9.7-4.el7
qt - update to 4.8.7-50
qt-devel - update to 4.8.7-50
qt-debuginfo - update to 4.8.7-50
qt-debugsource - update to 4.8.7-50
qt5-qtbase - update to 5.6.1-6.el6
qtbase-opensource-src (Debian package) - addressed in versions 5.7.1+dfsg-3+deb9u2, 5.11.3+dfsg1-1+deb10u3

• http://seclists.org/oss-sec/2020/q1/43
• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00347.html

• Untrusted search path in Qt
• Ubuntu update for Qt
• Gentoo update for QtCore
• Multiple vulnerabilities in Intel BIOS firmware
• Red Hat Enterprise Linux 7 update for qt5-qtbase
• Debian update for qtbase-opensource-src
• openEuler 20.03 LTS update for qt
• Fedora EPEL 6 update for qt5-qtbase