REDHAT-BUG-2487269: Buffer Overflow
SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH query processing, leading to a heap buffer overflow of attacker-controlled data in applications compiled with SQLITEENABLEFTS5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
sqliteto a version that resolves this vulnerability.Fixed in 3.53.2 - Compensating control
Ensure applications compiled with SQLITE_ENABLE_FTS5 do not process untrusted/crafted FTS5 MATCH queries from attacker-controlled databases until the SQLite upgrade to 3.53.2 is applied.
Event History
Frequently Asked Questions
Which applications are exposed?
Applications using SQLite versions before 3.53.2 are exposed when they are compiled with SQLITE_ENABLE_FTS5 and process FTS5 MATCH queries against an attacker-crafted database.
What does an attacker need to exploit this issue?
The attacker needs to supply a crafted database containing malicious FTS5 continuation-page metadata with a szLeaf value smaller than 4. Exploitation is triggered during FTS5 MATCH query processing.
How can I determine whether my deployment is affected?
Check whether the SQLite version is earlier than 3.53.2 and whether the application was compiled with SQLITE_ENABLE_FTS5. The vulnerable path requires FTS5 MATCH query processing of the crafted database.
What should be done if immediate patching is not possible?
Avoid processing untrusted SQLite databases through FTS5 MATCH queries in applications compiled with SQLITE_ENABLE_FTS5. Upgrade SQLite to version 3.53.2 or later when possible.