SQLite up to 3.31.x Snippet ext/fts3/fts3.c fts3EvalNextRow use after free

Summaryinfo

A vulnerability has been found in SQLite up to 3.31.x and classified as critical. Affected is the function fts3EvalNextRow of the file ext/fts3/fts3.c of the component Snippet Handler. The manipulation leads to use after free. This vulnerability is uniquely identified as CVE-2020-13630. The attack is possible to be carried out remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in SQLite up to 3.31.x. It has been rated as critical. This issue affects the function fts3EvalNextRow of the file ext/fts3/fts3.c of the component Snippet Handler. The manipulation with an unknown input leads to a use after free vulnerability. Using CWE to declare the problem leads to CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.

The weakness was disclosed 05/27/2020. The identification of this vulnerability is CVE-2020-13630 since 05/27/2020. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 236583 (Alibaba Cloud Linux 3 : 0111: sqlite (ALINUX3-SA-2022:0111)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.32.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (236583). The entries VDB-155629 and VDB-155628 are pretty similar. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• SQLite

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11
• 3.12
• 3.13
• 3.14
• 3.15
• 3.16
• 3.17
• 3.18
• 3.19
• 3.20
• 3.21
• 3.22
• 3.23
• 3.24
• 3.25
• 3.26
• 3.27
• 3.28
• 3.29
• 3.30
• 3.31

License

• free

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion