Bug 1841231 (CVE-2020-13435) - CVE-2020-13435 sqlite: NULL pointer dereference in sqlite3ExprCodeTarget()
Summary: CVE-2020-13435 sqlite: NULL pointer dereference in sqlite3ExprCodeTarget()
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-13435
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1841232 1841233 1841234 1841235 1846249 1846260 1846261
Blocks: 1841236
TreeView+ depends on / blocked
 
Reported: 2020-05-28 16:48 UTC by Guilherme de Almeida Suckevicz
Modified: 2023-09-26 14:52 UTC (History)
13 users (show)

Fixed In Version: sqlite 3.32.1
Clone Of:
Environment:
Last Closed: 2021-10-28 11:00:03 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:4396 0 None None None 2021-11-09 18:37:01 UTC

Description Guilherme de Almeida Suckevicz 2020-05-28 16:48:10 UTC 
SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c.

Reference and upstream commit:
https://www.sqlite.org/src/info/7a5279a25c57adf1
Comment 1 Guilherme de Almeida Suckevicz 2020-05-28 16:48:50 UTC 
Created mingw-sqlite tracking bugs for this issue:

Affects: fedora-all [bug 1841233]


Created sqlite tracking bugs for this issue:

Affects: fedora-all [bug 1841235]


Created sqlite2 tracking bugs for this issue:

Affects: epel-all [bug 1841232]
Affects: fedora-all [bug 1841234]
Comment 2 Mauro Matteo Cascella 2020-06-11 08:28:31 UTC 
Upstream fix:
https://www.sqlite.org/src/info/ad7bb70af9bb68d1
Comment 6 Mauro Matteo Cascella 2020-06-11 12:23:54 UTC 
Under some circumstances it is possible for a SQL expression to cause a NULL pointer dereference in sqlite3ExprCodeTarget() in expr.c, when the pInfo->aFunc struct pointer is set to 0. This may happen when rewriting a query for window functions, if the rewrite changes the depth of TK_AGG_FUNCTION nodes. An attacker would need to have a level of access that allows him to write particular SQL expressions to trigger this flaw, leading to a denial of service.
Comment 8 errata-xmlrpc 2021-11-09 18:36:59 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4396 https://access.redhat.com/errata/RHSA-2021:4396
Note You need to log in before you can comment on or make changes to this bug.