intel / intel/confidential-computing.sgx.sdk

[Security] External SQLite code could cause use-after-free

Open
#38 2 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
C++
Stars
2
Forks
3
PR merge metrics
No merged PRs in 30d

Description

Source: https://github.com/intel/linux-sgx/blob/master/external/sqlite/src/sqlite3.c

The responsibility to set the `sqlite3` object to 0 after `sqlite3_close()` have left to the user. The project `https://github.com/yerzhan7/SGX_SQLite` have already fall for it (https://github.com/yerzhan7/SGX_SQLite/issues/2) and exposes an use-after-free inside the intel sdk sqlite3 code.
One of the use of the use-after-free is here:
```cpp
int sqlite3SafetyCheckOk(sqlite3 *db){
u32 magic;
if( db==0 ){
return;
}
magic = db->magic; // use
}
```

The problematic free is here:
```cpp
SQLITE_API void sqlite3_free(void *p){
if( p==0 ) return; /* IMP: R-49053-54554 */
assert( sqlite3MemdebugHasType(p, MEMTYPE_HEAP) );
assert( sqlite3MemdebugNoType(p, (u8)~MEMTYPE_HEAP) );
if( sqlite3GlobalConfig.bMemstat ){
sqlite3_mutex_enter(mem0.mutex);
sqlite3StatusDown(SQLITE_STATUS_MEMORY_USED, sqlite3MallocSize(p));
sqlite3StatusDown(SQLITE_STATUS_MALLOC_COUNT, 1);
sqlite3GlobalConfig.m.xFree(p);
sqlite3_mutex_leave(mem0.mutex);
}else{
sqlite3GlobalConfig.m.xFree(p);
}
}
```
The solution must also consider concurrent event to use-after-free.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.