CVE-2023-7104 SQLite SQLite3 make alltest sqlite3session.c sessionReadRecord heap-based overflow
A heap-based buffer overflow in SQLite's session extension allows attackers to execute arbitrary code or cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-7104?
CVE-2023-7104 is a medium-severity memory corruption vulnerability in Fedoraproject Fedora, published on 25 Dec 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-248999.
Which versions are affected by CVE-2023-7104?
1 open source package ship an affected version, including sqlite. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
sqlite Bitnami | All versions | 3.43.1 |
Linux distribution packages (39)
lemon AlmaLinux:8 | All versions | 3.26.0-19.el8_9 |
sqlite AlmaLinux:8 | All versions | 3.26.0-19.el8_9 |
sqlite-devel AlmaLinux:8 | All versions | 3.26.0-19.el8_9 |
sqlite-doc AlmaLinux:8 | All versions | 3.26.0-19.el8_9 |
sqlite-libs AlmaLinux:8 | All versions | 3.26.0-19.el8_9 |
sqlite AlmaLinux:9 | All versions | 3.34.1-7.el9_3 |
sqlite-devel AlmaLinux:9 | All versions | 3.34.1-7.el9_3 |
sqlite-libs AlmaLinux:9 | All versions | 3.34.1-7.el9_3 |
lemon Red Hat:enterprise_linux:8::appstream | All versions | 0:3.26.0-19.el8_9 |
lemon-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:3.26.0-19.el8_9 |
sqlite-analyzer-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:3.26.0-19.el8_9 |
sqlite-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:3.26.0-19.el8_9 |
sqlite-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:3.26.0-19.el8_9 |
sqlite-libs-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:3.26.0-19.el8_9 |
sqlite-tcl-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:3.26.0-19.el8_9 |
lemon-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:3.26.0-19.el8_9 |
sqlite Red Hat:enterprise_linux:8::baseos | All versions | 0:3.26.0-19.el8_9 |
sqlite-analyzer-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:3.26.0-19.el8_9 |
sqlite-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:3.26.0-19.el8_9 |
sqlite-debugsource Red Hat:enterprise_linux:8::baseos | All versions | 0:3.26.0-19.el8_9 |
sqlite-devel Red Hat:enterprise_linux:8::baseos | All versions | 0:3.26.0-19.el8_9 |
sqlite-doc Red Hat:enterprise_linux:8::baseos | All versions | 0:3.26.0-19.el8_9 |
sqlite-libs Red Hat:enterprise_linux:8::baseos | All versions | 0:3.26.0-19.el8_9 |
sqlite-libs-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:3.26.0-19.el8_9 |
sqlite-tcl-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:3.26.0-19.el8_9 |
lemon-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:3.34.1-7.el9_3 |
sqlite Red Hat:enterprise_linux:9::appstream | All versions | 0:3.34.1-7.el9_3 |
sqlite-analyzer-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:3.34.1-7.el9_3 |
sqlite-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:3.34.1-7.el9_3 |
sqlite-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:3.34.1-7.el9_3 |
sqlite-devel Red Hat:enterprise_linux:9::appstream | All versions | 0:3.34.1-7.el9_3 |
sqlite-libs-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:3.34.1-7.el9_3 |
sqlite-tcl-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:3.34.1-7.el9_3 |
sqlite-tools-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:3.34.1-7.el9_3 |
lemon-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 0:3.34.1-7.el9_3 |
sqlite Red Hat:enterprise_linux:9::baseos | All versions | 0:3.34.1-7.el9_3 |
sqlite-analyzer-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 0:3.34.1-7.el9_3 |
sqlite-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 0:3.34.1-7.el9_3 |
sqlite-debugsource Red Hat:enterprise_linux:9::baseos | All versions | 0:3.34.1-7.el9_3 |
Products include Fedoraproject Fedora, Sqlite Sqlite.
How do I fix CVE-2023-7104?
Upgrade sqlite to 3.43.1 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2023-7104 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-7104 exists.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as ALPINE-CVE-2023-7104, ALSA-2024:0253, ALSA-2024:0465, AZL-32297, BELL-CVE-2023-7104, BIT-sqlite-2023-7104 and 17 more.