Out-of-bounds read in Qt - CVE-2021-3481

Vulnerability identifier: #VU66866

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-3481

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information or crash the application.

The vulnerability exists due to a boundary condition within the QRadialFetchSimd in qt/qtbase/src/gui/painting/qdrawhelper_p.h in Qt/Qtbase when rendering and displaying a crafted Scalable Vector Graphics (SVG) file. A remote attacker can create a specially crafted SVG file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system or crash the application.

Qt
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat Enterprise Linux for x86_64
SUSE Linux Enterprise Server
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Workstation Extension
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Module for Desktop Applications
Ubuntu
qgnomeplatform (Red Hat package)
adwaita-qt (Red Hat package)
libqt4-linguist-debuginfo
libqt4-debugsource
libqt4-linguist
libqt4-devel-debuginfo
libqt4-devel
libqt4-debuginfo
libqt4-sql-unixODBC-debuginfo
libqt4-sql-unixODBC-debuginfo-32bit
libqt4-sql-unixODBC
libqt4-sql-unixODBC-32bit
libqt4-sql-sqlite-debuginfo-32bit
libqt4-sql-sqlite-32bit
libqt4-sql-postgresql-debuginfo
libqt4-sql-postgresql-debuginfo-32bit
libqt4-sql-postgresql
libqt4-sql-postgresql-32bit
libqt4-sql-plugins-debugsource
libqt4-sql-mysql-32bit
libqt4-sql-mysql-debuginfo-32bit
libqt4-sql-sqlite-debuginfo
libqt4-x11-debuginfo-32bit
libqt4-x11-32bit
libqt4-sql-debuginfo-32bit
libqt4-sql-32bit
libqt4-qt3support-debuginfo-32bit
libqt4-qt3support-32bit
libqt4-32bit
libqt4-x11-debuginfo
libqt4-x11
libqt4-private-headers-devel
libqt4-sql-sqlite
libqt4-sql-mysql-debuginfo
libqt4-sql-mysql
libqt4-sql-debuginfo
libqt4-sql
libqt4-qt3support-debuginfo
libqt4-qt3support
libqt4
libqt4-debuginfo-32bit
libqt4-devel-doc
libqt4-devel-doc-debuginfo
libqt4-devel-doc-debugsource
libqt4-devel-doc-data
qt4-x11-tools
qt4-x11-tools-debuginfo
sip (Red Hat package)
libQt5Svg5-debuginfo
libQt5Svg5
libqt5-qtsvg-private-headers-devel
libqt5-qtsvg-devel
libqt5-qtsvg-debugsource
libqt5svg5 (Ubuntu package)
qt5-qtcanvas3d (Red Hat package)
python-qt5 (Red Hat package)
qt5 (Red Hat package)
qt5-qttranslations (Red Hat package)
qt5-qtdoc (Red Hat package)
qt5-qtmultimedia (Red Hat package)
qt5-qt3d (Red Hat package)
qt5-qtconnectivity (Red Hat package)
qt5-qtdeclarative (Red Hat package)
qt5-qtgraphicaleffects (Red Hat package)
qt5-qtimageformats (Red Hat package)
qt5-qtlocation (Red Hat package)
qt5-qtwayland (Red Hat package)
qt5-qtquickcontrols (Red Hat package)
qt5-qtquickcontrols2 (Red Hat package)
qt5-qtscript (Red Hat package)
qt5-qtsensors (Red Hat package)
qt5-qtserialport (Red Hat package)
qt5-qtxmlpatterns (Red Hat package)
qt5-qtx11extras (Red Hat package)
qt5-qtwebsockets (Red Hat package)
qt5-qtwebchannel (Red Hat package)
qt5-qtserialbus (Red Hat package)
qt5-qtsvg (Red Hat package)
qt5-qtbase (Red Hat package)
qt5-qttools (Red Hat package)
Red Hat OpenShift Container Platform

Install updates from vendor's website.

Qt - addressed in versions 5.12.11, 5.15.4, 6.0.3
qgnomeplatform (Red Hat package) - update to 0.7.1-2.el8
adwaita-qt (Red Hat package) - update to 1.2.1-3.el8
libqt4-linguist-debuginfo - update to 4.8.7-8.16.1
libqt4-debugsource - update to 4.8.7-8.16.1
libqt4-linguist - update to 4.8.7-8.16.1
libqt4-devel-debuginfo - update to 4.8.7-8.16.1
libqt4-devel - update to 4.8.7-8.16.1
libqt4-debuginfo - update to 4.8.7-8.16.1
libqt4-sql-unixODBC-debuginfo - update to 4.8.7-8.16.1
libqt4-sql-unixODBC-debuginfo-32bit - update to 4.8.7-8.16.1
libqt4-sql-unixODBC - update to 4.8.7-8.16.1
libqt4-sql-unixODBC-32bit - update to 4.8.7-8.16.1
libqt4-sql-sqlite-debuginfo-32bit - update to 4.8.7-8.16.1
libqt4-sql-sqlite-32bit - update to 4.8.7-8.16.1
libqt4-sql-postgresql-debuginfo - update to 4.8.7-8.16.1
libqt4-sql-postgresql-debuginfo-32bit - update to 4.8.7-8.16.1
libqt4-sql-postgresql - update to 4.8.7-8.16.1
libqt4-sql-postgresql-32bit - update to 4.8.7-8.16.1
libqt4-sql-plugins-debugsource - update to 4.8.7-8.16.1
libqt4-sql-mysql-32bit - update to 4.8.7-8.16.1
libqt4-sql-mysql-debuginfo-32bit - update to 4.8.7-8.16.1
libqt4-sql-sqlite-debuginfo - update to 4.8.7-8.16.1
libqt4-x11-debuginfo-32bit - update to 4.8.7-8.16.1
libqt4-x11-32bit - update to 4.8.7-8.16.1
libqt4-sql-debuginfo-32bit - update to 4.8.7-8.16.1
libqt4-sql-32bit - update to 4.8.7-8.16.1
libqt4-qt3support-debuginfo-32bit - update to 4.8.7-8.16.1
libqt4-qt3support-32bit - update to 4.8.7-8.16.1
libqt4-32bit - update to 4.8.7-8.16.1
libqt4-x11-debuginfo - update to 4.8.7-8.16.1
libqt4-x11 - update to 4.8.7-8.16.1
libqt4-private-headers-devel - update to 4.8.7-8.16.1
libqt4-sql-sqlite - update to 4.8.7-8.16.1
libqt4-sql-mysql-debuginfo - update to 4.8.7-8.16.1
libqt4-sql-mysql - update to 4.8.7-8.16.1
libqt4-sql-debuginfo - update to 4.8.7-8.16.1
libqt4-sql - update to 4.8.7-8.16.1
libqt4-qt3support-debuginfo - update to 4.8.7-8.16.1
libqt4-qt3support - update to 4.8.7-8.16.1
libqt4 - update to 4.8.7-8.16.1
libqt4-debuginfo-32bit - update to 4.8.7-8.16.1
libqt4-devel-doc - update to 4.8.7-8.16.2
libqt4-devel-doc-debuginfo - update to 4.8.7-8.16.2
libqt4-devel-doc-debugsource - update to 4.8.7-8.16.2
libqt4-devel-doc-data - update to 4.8.7-8.16.2
qt4-x11-tools - update to 4.8.7-8.16.2
qt4-x11-tools-debuginfo - update to 4.8.7-8.16.2
Red Hat OpenShift Container Platform - update to 4.11.0
sip (Red Hat package) - update to 4.19.24-2.el8
libQt5Svg5-debuginfo - addressed in versions 5.6.2-3.6.1, 5.12.7-3.3.1
libQt5Svg5 - addressed in versions 5.6.2-3.6.1, 5.12.7-3.3.1
libqt5-qtsvg-private-headers-devel - addressed in versions 5.6.2-3.6.1, 5.12.7-3.3.1
libqt5-qtsvg-devel - addressed in versions 5.6.2-3.6.1, 5.12.7-3.3.1
libqt5-qtsvg-debugsource - addressed in versions 5.6.2-3.6.1, 5.12.7-3.3.1
libqt5svg5 (Ubuntu package) - update to 5.9.5-0ubuntu1.1
qt5-qtcanvas3d (Red Hat package) - update to 5.12.5-3.el8
python-qt5 (Red Hat package) - update to 5.15.0-2.el8
qt5 (Red Hat package) - update to 5.15.2-1.el8
qt5-qttranslations (Red Hat package) - update to 5.15.2-1.el8
qt5-qtdoc (Red Hat package) - update to 5.15.2-1.el8
qt5-qtmultimedia (Red Hat package) - update to 5.15.2-2.el8
qt5-qt3d (Red Hat package) - update to 5.15.2-2.el8
qt5-qtconnectivity (Red Hat package) - update to 5.15.2-2.el8
qt5-qtdeclarative (Red Hat package) - update to 5.15.2-2.el8
qt5-qtgraphicaleffects (Red Hat package) - update to 5.15.2-2.el8
qt5-qtimageformats (Red Hat package) - update to 5.15.2-2.el8
qt5-qtlocation (Red Hat package) - update to 5.15.2-2.el8
qt5-qtwayland (Red Hat package) - update to 5.15.2-2.el8
qt5-qtquickcontrols (Red Hat package) - update to 5.15.2-2.el8
qt5-qtquickcontrols2 (Red Hat package) - update to 5.15.2-2.el8
qt5-qtscript (Red Hat package) - update to 5.15.2-2.el8
qt5-qtsensors (Red Hat package) - update to 5.15.2-2.el8
qt5-qtserialport (Red Hat package) - update to 5.15.2-2.el8
qt5-qtxmlpatterns (Red Hat package) - update to 5.15.2-2.el8
qt5-qtx11extras (Red Hat package) - update to 5.15.2-2.el8
qt5-qtwebsockets (Red Hat package) - update to 5.15.2-2.el8
qt5-qtwebchannel (Red Hat package) - update to 5.15.2-2.el8
qt5-qtserialbus (Red Hat package) - update to 5.15.2-3.el8
qt5-qtsvg (Red Hat package) - update to 5.15.2-3.el8
qt5-qtbase (Red Hat package) - update to 5.15.2-3.el8
qt5-qttools (Red Hat package) - update to 5.15.2-3.el8

• https://codereview.qt-project.org/c/qt/qtsvg/+/337646
• https://bugzilla.redhat.com/show_bug.cgi?id=1931444
• https://bugreports.qt.io/browse/QTBUG-91507
• https://access.redhat.com/security/cve/CVE-2021-3481

• Information disclosure in Qt
• Multiple vulnerabilities in OpenShift Container Platform 4.11
• Red Hat Enterprise Linux 8 update for qt5
• SUSE update for libqt5-qtsvg
• SUSE update for libqt5-qtsvg
• SUSE update for libqt4
• Ubuntu update for qtsvg-opensource-src