Attacker Value
Very Low
(1 user assessed)
Exploitability
Moderate
(1 user assessed)
User Interaction
None
Privileges Required
None
Attack Vector
Network
2

CVE-2022-35737

Disclosure Date: August 03, 2022
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.

Add Assessment

1
Ratings
  • Attacker Value
    Very Low
  • Exploitability
    Medium
Technical Analysis

CVE-2022-35737 is a vulnerability in SQLite, specifically in versions 1.0.12 through 3.39.x before 3.39.2. It allows for an array-bounds overflow if a string argument to a C API contains billions of bytes. This vulnerability can lead to various consequences, ranging from a simple application crash to arbitrary code execution.

  • The issue lies in the sqlite3_snprintf function’s code, used in C/C++ programming for database interaction. Passing an exceedingly large string input (over 2 GB) to this function can cause a crash, enabling a denial of service (DoS) attack.
  • This bug likely entered the code 22 years ago and remained undetected due to the improbability of passing gigabytes of data as function parameters at that time.
  • The vulnerability was closed with the release of SQLite 3.39.2 in July 2022. However, software that includes SQLite needs to be updated to incorporate this fix.

The vector string for this score is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating network access for the attack, low attack complexity, no privileges required, no user interaction required, no scope change, and high impact on availability.

Affected Platforms:

  • This vulnerability affects various platforms, including those running Amazon Linux, where updates have been provided to address this issue.

Mitigation and Impact:

  • The vulnerability is specific to the interface for C applications and only if the code is compiled with certain parameters.
  • The practical exploitability of this vulnerability is still a subject of research, with limitations on its impact based on how SQLite is compiled and used in applications.

Additional Considerations:

  • This vulnerability is notable for its long presence in the SQLite code and the challenges in detecting it using standard testing methods like fuzzing.

In terms of exploitation, the vulnerability’s practical use for an attack is still under investigation, with researchers pointing to several limitations that reduce the likelihood of successful exploitation.

CVSS V3 Severity and Metrics
Base Score:
7.5 High
Impact Score:
3.6
Exploitability Score:
3.9
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
None
Integrity (I):
None
Availability (A):
High

General Information

Vendors

  • netapp,
  • splunk,
  • sqlite

Products

  • ontap select deploy administration utility -,
  • sqlite,
  • universal forwarder,
  • universal forwarder 9.1.0

Additional Info

Technical Analysis