Openlink Virtuoso-Opensource Denial-of-Service Vulnerability in SQL Processing Component

A denial-of-service vulnerability has been identified in Openlink Virtuoso-Opensource version 7.2.11. The issue arises in the 'chash_array' component, where attackers can cause a crash by executing specially crafted SQL statements. This vulnerability can be reproduced using the Virtuoso database management system by inserting a specific SQL payload that exploits the lack of proper argument checks in 'ORDER BY' and 'GROUP BY' clauses.

Impact

Exploitation of this vulnerability leads to a crash of the Virtuoso database server, causing a denial-of-service condition where the server becomes unresponsive or unavailable.

Reproduction

The vulnerability can be reproduced by running Openlink Virtuoso-Opensource 7.2.11 in a Docker container. After the server is started, a proof-of-concept SQL file can be executed using the 'isql' command-line interface. The crafted SQL statement, which exploits the vulnerability, causes the 'chash_array' component to crash, as evidenced by a backtrace showing the crash sequence.

Remediation

Users can update to the latest version of Openlink Virtuoso-Opensource, where this vulnerability has been fixed.