- Reported
-
- Issued
-
- Package
-
sqlcipher-src
(crates.io)
- Type
-
Vulnerability
- Categories
-
- Keywords
-
#sqlite
#sqlcipher
#wal
#uninitialized-memory
#information-disclosure
- Aliases
-
- References
-
- CVSS Score
- 6.8
MEDIUM
- CVSS Details
-
- Attack Complexity
- Low
- Attack Requirements
- None
- Attack Vector
- Local
- Privileges Required
- None
- Availability Impact to the Subsequent System
- None
- Confidentiality Impact to the Subsequent System
- None
- Integrity Impact to the Subsequent System
- None
- User Interaction
- Passive
- Availability Impact to the Vulnerable System
- None
- Confidentiality Impact to the Vulnerable System
- High
- Integrity Impact to the Vulnerable System
- None
- CVSS Vector
- CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- Patched
-
- Unaffected
-
Description
SQLite versions before 3.54.0 can return uninitialized page-cache memory when a process opens a database file together with a sibling write-ahead-log (-wal) file whose page size differs from the database's. A crafted pair of files can make ordinary queries return stale bytes from the process's memory. The attack vector is local and needs the victim to open the files.
sqlcipher-src ships the SQLCipher amalgamation (SQLCipher is built on SQLite and contains the same sqlite3WalReadFrame code) for -sys crates to compile, so a build that uses it is susceptible to the vulnerability. The releases 419.0.3 to 419.0.6 bundle SQLCipher 4.19.0 on SQLite 3.53.4 and are affected. sqlcipher-src was updated in 420.0.0 (SQLCipher 4.20.0 on SQLite 3.54.1), which contains the fix. The releases 0.1.0 and 0.1.1 contain no SQLCipher source. libsqlite3-sys 0.39.0 and 0.39.1 depend on sqlcipher-src =419.0.6 for their bundled-sqlcipher feature.
Only a process that opens a database file, with its -wal, that a less trusted party could have written is exposed.
Advisory available under CC0-1.0
license.