Use-after-free in SQLite - CVE-2021-20227

Vulnerability identifier: #VU51834

CSH Severity: Medium

CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-20227

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows an attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing SELECT queries in "src/select.c" if a subquery with both a correlated WHERE clause and a "HAVING 0" clause is used and the parent query is an aggregate. A remote attacker can execute a specially crafted query to trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

SQLite
Gentoo Linux
Junos OS
openEuler
Ubuntu
Junos OS Evolved
Oracle Communications Network Charging and Control
IBM MaaS360 Base Module
IBM MaaS360 Ceriticate Integration Module
MySQL Workbench
Oracle Outside In Technology
IBM MaaS360 VPN Module
IBM MaaS360 Cloud Extender Agent
Tivoli Composite Application Manager for Transactions
sqlite-help
sqlite-devel
sqlite-debugsource
sqlite-debuginfo
sqlite
libsqlite3-0 (Ubuntu package)
sqlite3 (Ubuntu package)
dev-db/sqlite
PowerScale OneFS

Install updates from vendor's website.

SQLite - update to 3.34.1
Oracle Communications Network Charging and Control - update to 12.0.4.0.0
MySQL Workbench - update to 8.0.27
Junos OS - addressed in versions 19.3R3-S6, 19.4R2-S6, 19.4R3-S8, 20.1R3-S4, 20.2R3-S4, 20.3R3-S3
Junos OS Evolved - addressed in versions 21.2R3-EVO, 21.3R3-EVO, 21.4R2-EVO, 22.1R1-EVO
IBM MaaS360 Base Module - update to 2.105.300.005
IBM MaaS360 VPN Module - update to 2.105.300.005
IBM MaaS360 Ceriticate Integration Module - update to 2.105.300.005
IBM MaaS360 Cloud Extender Agent - update to 2.105.300.005
sqlite-help - update to 3.32.3-3
sqlite-devel - update to 3.32.3-3
sqlite-debugsource - update to 3.32.3-3
sqlite-debuginfo - update to 3.32.3-3
sqlite - update to 3.32.3-3
libsqlite3-0 (Ubuntu package) - update to 3.33.0-1ubuntu0.1
sqlite3 (Ubuntu package) - update to 3.33.0-1ubuntu0.1
dev-db/sqlite - update to 3.39.2
Tivoli Composite Application Manager for Transactions - addressed in versions 7.4.0.1.54, 7.4.0.2.16
PowerScale OneFS - update to 9.4.0.14

• https://bugzilla.redhat.com/show_bug.cgi?id=1924886
• https://security.gentoo.org/glsa/202103-04
• https://www.sqlite.org/releaselog/3_34_1.html

• Use-after-free in SQLite
• Gentoo update for SQLite
• Multiple vulnerabilities in Oracle Outside In Technology
• Multiple vulnerabilities in Oracle Communications Network Charging and Control
• Multiple vulnerabilities in MySQL Workbench
• Ubuntu update for sqlite3
• Juniper Junos OS and Junos OS Evolved update for SQLite
• Use-after-free in IBM Tivoli Composite Application Manager for Transactions
• Multiple vulnerabilities in IBM MaaS360 Cloud Extender and Modules
• Gentoo update for SQLite
• Multiple vulnerabilities in Dell EMC PowerScale OneFS
• openEuler 20.03 LTS SP1 update for sqlite