Bug 1841562 (CVE-2020-13630)
| Summary: | CVE-2020-13630 sqlite: Use-after-free in fts3EvalNextRow in ext/fts3/fts3.c | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Guilherme de Almeida Suckevicz <gsuckevi> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | alex, databases-maint, drizt72, erik-fedora, fedora, itamar, mschorm, odubaj, pkubat, praiskup, rh-spice-bugs, rjones, wilmer5 |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | sqlite 3.32.0 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A use-after-free vulnerability was found in the SQLite FTS3 extension module in the way it implemented the snippet function. This flaw allows an attacker who can execute SQL statements to crash the application or potentially execute arbitrary code.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-11-04 02:25:33 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1841564, 1841565, 1841566, 1845153, 1845212 | ||
| Bug Blocks: | 1841236 | ||
|
Description
Guilherme de Almeida Suckevicz
2020-05-29 13:23:34 UTC
Created mingw-sqlite tracking bugs for this issue: Affects: fedora-all [bug 1841564] Created sqlite tracking bugs for this issue: Affects: fedora-all [bug 1841566] Created sqlite2 tracking bugs for this issue: Affects: fedora-all [bug 1841565] This flaw was apparently introduced in SQLite upstream version 3.8.9 with the following commit: -> https://github.com/sqlite/sqlite/commit/18f6ff9eb7db02356102283c28053b0a602f55d7 Statement: This flaw did not affect the versions of SQLite as shipped with Red Hat Enterprise Linux 7 as they did not include the vulnerable code, which was introduced in a later version of the package. According to the documentation, FTS3 is an extension module that allows users to create special virtual tables with a built-in full-text index to efficiently perform full-text searches on a set of documents (https://www.sqlite.org/fts3.html). Under some circumstances it is possible for a SQL SELECT statement to cause a use-after-free while performing a full-text query on FTS3 virtual tables. Specifically, a new SegReader object can be allocated, free'd and then used in functions sqlite3Fts3SegReaderNew(), sqlite3Fts3SegReaderFree() and fts3SnippetAdvance() respectively. For this attack to be successful, an attacker would need to have a level of access that allows him to write particular SQL expressions that use the snippet function to perform full-text queries on FTS3 tables. This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:4442 https://access.redhat.com/errata/RHSA-2020:4442 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-13630 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:1968 https://access.redhat.com/errata/RHSA-2021:1968 |