SQLite version vulnerability #26392

1. 
   neila commented at 11:51 am on October 26, 2022: none

   https://github.com/bitcoin/bitcoin/blob/69b10212ea5370606c7a5aa500a70c36b4cbb58f/depends/packages/sqlite.mk#L2

   SQLite version is before vulnerability CVE-2022-35737 was fixed, details of which are described here.

2. 
   ghost commented at 12:42 pm on October 26, 2022: none

   On vulnerable systems, CVE-2022-35737 is exploitable when large string inputs are passed to the SQLite implementations of the printf functions and when the format string contains the %Q, %q, or %w format substitution types. This is enough to cause the program to crash. We also show that if the format string contains the ! special character to enable unicode character scanning, then it is possible to achieve arbitrary code execution in the worst case, or to cause the program to hang and loop (nearly) indefinitely.

   %w is only used at one place for wallet_name:

   https://github.com/bitcoin/bitcoin/blob/69b10212ea5370606c7a5aa500a70c36b4cbb58f/src/wallet/wallet.cpp#L1046

3. 
   sipa commented at 12:46 pm on October 26, 2022: member

   We don’t use sqlite3_printf anywhere, so I don’t believe we can be affected. @1440000bytes That “%w” is unrelated, that’s for command substitution, not in a sqlite3_printf format string.
4. MarcoFalke closed this on Oct 26, 2022

   ---

5. MarcoFalke added the label Wallet on Oct 26, 2022
6. MarcoFalke added the label Questions and Help on Oct 26, 2022
7. fanquake locked this on Oct 28, 2022

Contributors
neila ghost sipa

Labels
Wallet Questions and Help