CVE-2025-23050

Executive Summary

CVE-2025-23050 is a low-severity vulnerability in the Qt framework's QLowEnergyController component, which handles Bluetooth Low Energy (BLE) communication. The flaw involves improper validation of malformed Bluetooth ATT (Attribute Protocol) commands, leading to an out-of-bounds read or division by zero condition. This can cause a denial of service (DoS) by crashing the application or service using the vulnerable Qt library.

The vulnerability affects Qt versions prior to 5.15.19, 6.5.9, and 6.8.2. The CVSS score is 3.1 (Low), with an attack vector requiring adjacent network access (Bluetooth range). No public proof-of-concept (PoC) or exploit code is currently available, and the EPSS score is 0.0%, indicating a very low likelihood of exploitation in the wild.

Supply Chain & Package Security

Qt is a widely used cross-platform framework for developing applications, including desktop, mobile, and embedded systems. This vulnerability is embedded in the Qt library itself, meaning any application that links against a vulnerable version of Qt and uses BLE functionality is affected. Organizations should audit their software supply chain for Qt dependencies and ensure they are updated to patched versions.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Adjacent Network (AV:A) – Exploitation requires the attacker to be within Bluetooth range.
• Attack Complexity (AC): Low (AC:L) – No special conditions required.
• Privileges Required (PR): None (PR:N) – No authentication needed.
• User Interaction (UI): None (UI:N) – No user action required.
• Scope (S): Unchanged (S:U) – Impact is confined to the vulnerable component.
• Confidentiality (C): None (C:N) – No data exposure.
• Integrity (I): None (I:N) – No data modification.
• Availability (A): Low (A:L) – Denial of service is possible.

Threat Level: Low. The vulnerability requires physical proximity via Bluetooth and only results in a denial of service. No remote code execution or data theft is possible.

Deep Dive & Mechanics

The vulnerability resides in the QLowEnergyController class, which is part of Qt's Bluetooth module. This class manages BLE connections and processes ATT protocol data units (PDUs). The flaw occurs when parsing malformed ATT commands, specifically when handling attribute data lengths or offsets.

When a malformed ATT command is received, the code fails to validate the length of the incoming data before reading from a buffer. This leads to an out-of-bounds read, potentially reading memory beyond the allocated buffer. In some cases, the malformed data can cause a division by zero if the code attempts to use an invalid length as a divisor.

The root cause is insufficient input validation in the ATT command handler. The fix involves adding proper bounds checking and validation of ATT PDU lengths before processing.

Vulnerable vs. Patched Code

The vulnerable code path is in the QLowEnergyControllerPrivate class, specifically in the method that processes ATT write and read requests.

Vulnerable Code (simplified):

void QLowEnergyControllerPrivate::processAttCommand(const QByteArray &data) {
    int offset = data[0]; // No bounds check
    int length = data[1]; // No bounds check
    // Use offset and length to read from internal buffer
    QByteArray value = m_buffer.mid(offset, length); // Out-of-bounds read possible
    // ...
}

Patched Code (simplified):

void QLowEnergyControllerPrivate::processAttCommand(const QByteArray &data) {
    if (data.size() < 2) {
        // Invalid command, reject
        return;
    }
    int offset = static_cast<quint8>(data[0]);
    int length = static_cast<quint8>(data[1]);
    if (offset + length > m_buffer.size()) {
        // Bounds check, reject
        return;
    }
    QByteArray value = m_buffer.mid(offset, length);
    // ...
}

The patched code adds size checks for the incoming data and validates that the requested offset and length do not exceed the internal buffer size.

Exploitation & Lab Setup

Red Team

No public exploit code is available. To simulate the vulnerability in a lab environment:

1. Setup: Use two machines with Bluetooth adapters. One runs a vulnerable Qt application (e.g., a BLE peripheral simulator), and the other runs a custom BLE central that sends malformed ATT commands.
2. Craft Malformed ATT PDU: Create a raw ATT command with an invalid length field (e.g., length > actual data size) or an offset that causes an out-of-bounds read.
3. Send Command: Use a tool like gatttool or a custom Python script with pybluez to send the malformed ATT write request to the vulnerable device.
4. Observe Crash: The vulnerable application should crash or become unresponsive due to a segmentation fault or division by zero.

Example Python script (conceptual):

import bluetooth
import struct

# Connect to target BLE device
sock = bluetooth.BluetoothSocket(bluetooth.L2CAP)
sock.connect(('AA:BB:CC:DD:EE:FF', 0x0004))

# Craft malformed ATT Write Request (opcode 0x52)
# Invalid length field (0xFF) causing out-of-bounds read
att_pdu = struct.pack('BB', 0x52, 0xFF) + b'\x00' * 10
sock.send(att_pdu)
sock.close()

Blue Team

To detect exploitation attempts:

1. Monitor Bluetooth logs: Use btmon or bluetoothd logs to capture malformed ATT commands.
2. Network monitoring: Use Wireshark with BLE dissection to inspect ATT PDUs for anomalies.
3. Application crash monitoring: Monitor for crashes in Qt applications that use BLE, especially segmentation faults or division by zero errors.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Malformed ATT Write Requests (opcode 0x52) with invalid length fields.
  • ATT PDUs with length values exceeding the actual data size.
• Host IOCs:
  • Application crashes with SIGSEGV or SIGFPE signals.
  • Log entries in bluetoothd indicating invalid ATT commands.
  • Core dumps from Qt applications using QLowEnergyController.

Detection Engineering

YARA Rule

rule CVE_2025_23050_Qt_BLE_DoS {
    meta:
        description = "Detects malformed ATT commands targeting Qt BLE vulnerability"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-23050"
    strings:
        $att_write = { 52 ?? } // ATT Write Request opcode 0x52 followed by any byte
        $att_read = { 0a ?? }  // ATT Read Request opcode 0x0a followed by any byte
    condition:
        $att_write or $att_read
}

Sigma Rule

title: CVE-2025-23050 Qt BLE DoS Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects malformed Bluetooth ATT commands targeting Qt QLowEnergyController
author: Valters IT
date: 2025-04-10
logsource:
    product: linux
    service: bluetooth
detection:
    selection:
        EventID: 1000 # Example event ID for Bluetooth errors
        Message|contains: 'Invalid ATT command'
    condition: selection
falsepositives:
    - Legitimate BLE testing tools
level: low

Suricata Rule

alert bluetooth any any -> any any (msg:"CVE-2025-23050 Qt BLE DoS Attempt"; content:"|52|"; offset:0; depth:1; content:"|ff|"; within:1; reference:cve,2025-23050; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Patch Immediately: Update Qt to version 5.15.19, 6.5.9, or 6.8.2 or later.
2. Disable BLE: If patching is not possible, disable Bluetooth functionality in applications using Qt's BLE module.
3. Network Segmentation: Ensure BLE devices are in physically secure environments to limit attacker proximity.
4. Input Validation: Implement additional input validation at the application layer for BLE data.
5. Monitor: Deploy detection rules (YARA, Sigma, Suricata) to identify exploitation attempts.

Valters IT