CVE-2022-35737 PoC — SQLite 输入验证错误漏洞

Description

Stranger strings: CVE-2022-35737

介绍

# CVE-2022-35737

Integer overflow in SQLite3 `sqlite3_str_vappendf` function.

CVSS 6.7 AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

CVE-2022-35737 was introduced in SQLite version 1.0.12 and fixed in release
3.39.2, available on July 21, 2022. It is exploitable on 64-bit systems, and
exploitability depends on how the program is compiled: arbitrary code execution
is confirmed when the library is compiled without stack canaries, but
unconfirmed when stack canaries are present; denial-of-service is confirmed in
all cases.

Large string inputs to the `sqlite3_str_vappendf` function can cause signed
integer overflow when the format specifier is `%q`, `%Q`, or `%w`. This can
cause user-controlled data to be written beyond the bounds of a stack-allocated
buffer, resulting in program crash, infinite loop, or possible arbitrary code
execution.

This repository contains proof-of-concept code that demonstrate the
exploitation of the vulnerability.

## Proofs-of-Concept

### `snprintf-good-example.c`

Demonstrate that `sqlite3_snprintf` correctly escapes all existing single-quote
characters and adds a leading and trailing single quote to a short string.

Expected outcome:

```
$ ./snprintf-good-example
src: hello, 'world'!
dst: 'hello, ''world''!'
```

### `snprintf-crash.c`

Demonstrate that `sqlite_snprintf` crashes when called with sufficiently large
strings.

Expected outcome: SIGSEGV

```
$ ./snprintf-crash
Segmentation fault (core dumped)
```

### `snprintf-control-pc.c`

Demonstrate that it is possible to control the length of the buffer overflow to
overwrite targeted data on the stack, like the stack canary and saved return
address.

Expected outcome: SIGABRT

```
$ ./snprintf-control-pc
*** stack smashing detected ***: terminated
Aborted (core dumped)
```

### `snprintf-livelock.c`

Demonstrate that it is possible to cause the vulnerable program to loop nearly
endlessly (2^64 iterations).

Expected outcome: loop endlessly (on a reasonable timescale)

```
$ ./snprintf-livelock
<no output>
^C
```

### `pdo-sqlite3-quote-poc.php`

Demonstrate that CVE-2022-35737 is reachable from the PHP interpreter when run
with non-default memory limits.

Expected outcome: SIGSEGV

```
$ php pdo-sqlite3-quote-poc.php
Segmentation fault (core dumped)
```

## Dockerfile

If desired, the proofs-of-concept can be executed in a Docker container that
has dependencies pinned to the vulnerable version of the SQLite library.

```
$ docker build -t cve-2022-35737 .
$ docker run -it --rm cve-2022-35737 /bin/bash
root@289cef859649:/poc# ./snprintf-crash
Segmentation fault (core dumped)
```

文件快照

备注