SQLite Integer Overflow Vulnerability in Key Info Function Allowing Denial-of-Service and Memory Information Disclosure

An integer overflow vulnerability has been identified in the sqlite3KeyInfoFromExprList function of SQLite. This issue affects versions 3.39.2 through 3.41.1. The vulnerability allows an attacker who can execute arbitrary SQL statements to cause a denial-of-service condition or disclose sensitive information from process memory. This is achieved by crafting a SELECT statement that includes a large number of expressions in the ORDER BY clause.

Impact

Exploitation of this vulnerability leads to a heap buffer overflow, causing a segmentation fault and allowing for potential arbitrary code execution.

Reproduction

The vulnerability can be reproduced by compiling SQLite with AFL++ and AddressSanitizer enabled, and then executing a SELECT statement with an excessive number of expressions in the ORDER BY clause. This can be done using the SQLite command-line interface.

Remediation

Users are advised to update to the latest version of SQLite, as this vulnerability has been fixed in the most recent release.