Description
SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node shadow table. Attackers can supply a database declaring %_node WITHOUT ROWID or with a RAISE(IGNORE) trigger so nodeWrite() hashes nodes as 0, crashing the process after node splits.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
SQLite SQLite
Default version status: unaffected
0 to < 3.54.0affected
References
- https://sqlite.org/src/info/6a9e1415659f9e75 ↗
- https://github.com/sqlite/sqlite/commit/d21bd37c7cfc1b85b17a6703555f0926b6236e04 ↗
- https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/rtree/rtree.c#L905 ↗
- https://sqlite.org/releaselog/3_54_0.html ↗
- https://abraxaslabs.tech/research/sqlite-rtree-rowid0 ↗
- https://github.com/sqlite/sqlite ↗
- https://www.vulncheck.com/advisories/sqlite-before-3.54.0-use-after-free-in-r-tree-nodewrite ↗