Heap-use-after-free in duckdb::Planner::CreatePlan
Summary
OSV-2022-487: Heap-use-after-free in duckdb::Planner::CreatePlan. Affects duckdb versions >= dfcb8a47c57fb694da20a47c92b81fe9e806fda6, < 6e099b510cf72f5fa62b9e5a2c14fdc39e89d4e4. Fixed in 6e099b510cf72f5fa62b9e5a2c14fdc39e89d4e4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
DuckDB is an in-memory analytical database system that aims to provide high-performance query execution on large datasets. It is designed to be embedded into other applications and supports SQL queries, transactions, and various data types. This vulnerability affects the Planner component of DuckDB, which is responsible for generating query execution plans.
Vulnerability Detail
The vulnerability identified as OSV-2022-487 is a heap-use-after-free issue in the duckdb::Planner::CreatePlan function. This vulnerability occurs when the function attempts to access memory that has already been freed. An attacker could potentially exploit this vulnerability to execute arbitrary code or cause a denial-of-service condition. The vulnerability was discovered through an OSS-Fuzz report and has been assigned a severity rating of HIGH.
How To Fix
Minimum fixed version
6e099b510cf72f5fa62b9e5a2c14fdc39e89d4e4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
In conclusion, the heap-use-after-free vulnerability in duckdb::Planner::CreatePlan could allow an attacker to execute arbitrary code or cause a denial-of-service condition. It is crucial for users of DuckDB to update their installations to a patched version to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for duckdb →
FAQ
DuckDB is an in-memory analytical database system designed for high-performance query execution on large datasets. It supports SQL queries, transactions, and various data types.
This vulnerability could potentially allow an attacker to execute arbitrary code or cause a denial-of-service condition.
This vulnerability was discovered through an OSS-Fuzz report, which is a continuous fuzzing service for open-source software.
This vulnerability has been assigned a severity rating of HIGH.
To fix this vulnerability, it is recommended to update the affected version of DuckDB to a patched version. Details on how to update can be found in the 'how_to_fix' section.
References
Related vulnerabilities
Recent vulnerabilities recorded for duckdb.
