intel / intel/confidential-computing.sgx.sdk
[Security] External SQLite code could cause use-after-free
- Dominant language
- C++
- Stars
- 2
- Forks
- 3
- PR merge metrics
- No merged PRs in 30d
Description
Source: https://github.com/intel/linux-sgx/blob/master/external/sqlite/src/sqlite3.c
The responsibility to set the `sqlite3` object to 0 after `sqlite3_close()` have left to the user. The project `https://github.com/yerzhan7/SGX_SQLite` have already fall for it (https://github.com/yerzhan7/SGX_SQLite/issues/2) and exposes an use-after-free inside the intel sdk sqlite3 code.
One of the use of the use-after-free is here:
```cpp
int sqlite3SafetyCheckOk(sqlite3 *db){
u32 magic;
if( db==0 ){
return;
}
magic = db->magic; // use
}
```
The problematic free is here:
```cpp
SQLITE_API void sqlite3_free(void *p){
if( p==0 ) return; /* IMP: R-49053-54554 */
assert( sqlite3MemdebugHasType(p, MEMTYPE_HEAP) );
assert( sqlite3MemdebugNoType(p, (u8)~MEMTYPE_HEAP) );
if( sqlite3GlobalConfig.bMemstat ){
sqlite3_mutex_enter(mem0.mutex);
sqlite3StatusDown(SQLITE_STATUS_MEMORY_USED, sqlite3MallocSize(p));
sqlite3StatusDown(SQLITE_STATUS_MALLOC_COUNT, 1);
sqlite3GlobalConfig.m.xFree(p);
sqlite3_mutex_leave(mem0.mutex);
}else{
sqlite3GlobalConfig.m.xFree(p);
}
}
```
The solution must also consider concurrent event to use-after-free.
Contributor guide
Assessment
This issue has not been assessed yet.