Описание
In SQLite 3.27.2, interleaving reads and writes in a single transaction with an fts5 virtual table will lead to a NULL Pointer Dereference in fts5ChunkIterate in sqlite3.c. This is related to ext/fts5/fts5_hash.c and ext/fts5/fts5_index.c.
A vulnerability was found in SQLite due to a NULL pointer dereference in the fts5ChunkIterate function within sqlite3.c, where an attacker could exploit this flaw by creating a specially crafted table, causing the application to crash and resulting in a denial of service condition.
Отчет
This vulnerability in the SQLite3 database engine is rated as Low Severity because of its technical nature and severely limited impact, this flaw is a NULL Pointer Dereference (CWE-476) that occurs within the code that handles full text search tables, specifically the fts5 virtual table functionality. The issue is triggered by specific, non-standard actions: interleaving read and write operations within a single database transaction when interacting with an fts5 table. While this condition can be exploited remotely by an unauthenticated user to cause the issue, the inherent mechanism of a NULL pointer dereference almost exclusively leads to a crash of the affected process. Therefore, the attack's outcome is contained to a low impact Denial of Service (DoS), meaning the database service temporarily stops working, but the attacker gains no ability to steal information, tamper with data, or execute unauthorized code on the host system. This issue did not affect the versions of sqlite as shipped with Red Hat Enterprise Linux 6 and 7 as they did not include support for fts5.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 5 | sqlite | Not affected | ||
| Red Hat Enterprise Linux 6 | sqlite | Not affected | ||
| Red Hat Enterprise Linux 7 | sqlite | Not affected | ||
| Red Hat Enterprise Linux 8 | sqlite | Fix deferred |
Показывать по
Дополнительная информация
Статус:
5.3 Medium
CVSS3
Связанные уязвимости
In SQLite 3.27.2, interleaving reads and writes in a single transaction with an fts5 virtual table will lead to a NULL Pointer Dereference in fts5ChunkIterate in sqlite3.c. This is related to ext/fts5/fts5_hash.c and ext/fts5/fts5_index.c.
In SQLite 3.27.2, interleaving reads and writes in a single transaction with an fts5 virtual table will lead to a NULL Pointer Dereference in fts5ChunkIterate in sqlite3.c. This is related to ext/fts5/fts5_hash.c and ext/fts5/fts5_index.c.
In SQLite 3.27.2, interleaving reads and writes in a single transactio ...
In SQLite 3.27.2, interleaving reads and writes in a single transaction with an fts5 virtual table will lead to a NULL Pointer Dereference in fts5ChunkIterate in sqlite3.c. This is related to ext/fts5/fts5_hash.c and ext/fts5/fts5_index.c.
Уязвимость компонентов ext/fts5/fts5_hash.c и ext/fts5/fts5_index.c системы управления базами данных SQLite, позволяющая нарушителю вызвать отказ в обслуживании
5.3 Medium
CVSS3