Description
SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafted footer key offsets. Attackers can supply a database file with a corrupted FTS5 index that, when deleted from with secure-delete enabled, corrupts heap memory and crashes the application.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
SQLite SQLite
Default version status: unaffected
0 to < 3.54.0affected
References
- https://sqlite.org/src/info/9cd4f9e920 ↗
- https://github.com/sqlite/sqlite/commit/d9de6eedbe918c074c7556400fa21df5960704d9 ↗
- https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts5/fts5_index.c#L5525 ↗
- https://sqlite.org/releaselog/3_54_0.html ↗
- https://abraxaslabs.tech/research/sqlite-fts5-securedel ↗
- https://github.com/sqlite/sqlite ↗
- https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-fts5-fts5dosecuredelete ↗