SQLite 3.26.0/3.27.0 SQL Command src/select.c sqlite3SelectPrep use after free

Summaryinfo

A vulnerability classified as critical has been found in SQLite 3.26.0/3.27.0. The impacted element is the function sqlite3SelectPrep of the file src/select.c of the component SQL Command Handler. This manipulation causes use after free. This vulnerability is handled as CVE-2019-5018. The attack can be initiated remotely. Additionally, an exploit exists. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability has been found in SQLite 3.26.0/3.27.0 and classified as critical. Affected by this vulnerability is the function sqlite3SelectPrep of the file src/select.c of the component SQL Command Handler. The manipulation with an unknown input leads to a use after free vulnerability. The CWE definition for the vulnerability is CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. A specially crafted SQL command can cause a use after free vulnerability, potentially resulting in remote code execution. An attacker can send a malicious SQL command to trigger this vulnerability.

The bug was discovered 05/09/2019. The weakness was released 05/09/2019 with Cisco Talos as TALOS-2019-0777 as confirmed vulnerability report (Website). The advisory is shared at talosintelligence.com. This vulnerability is known as CVE-2019-5018 since 01/04/2019. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details and also a public exploit are known. The advisory points out:

An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. A specially crafted SQL command can cause a use after free vulnerability, potentially resulting in remote code execution. An attacker can send a malicious SQL command to trigger this vulnerability.

After immediately, there has been an exploit disclosed. It is possible to download the exploit at talosintelligence.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 51 days. During that time the estimated underground price was around $0-$5k. The vulnerability scanner Nessus provides a plugin with the ID 236583 (Alibaba Cloud Linux 3 : 0111: sqlite (ALINUX3-SA-2022:0111)), which helps to determine the existence of the flaw in a target environment.

Applying a patch is able to eliminate this problem. A possible mitigation has been published before and not just after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (236583). Additional details are provided at blog.talosintelligence.com. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• SQLite

Version

• 3.26.0
• 3.27.0

License

• free

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion