CVE-2020-11656
📋 TL;DR
This CVE describes a use-after-free vulnerability in SQLite's ALTER TABLE implementation when used with ORDER BY clauses in compound SELECT statements. Attackers can exploit this to execute arbitrary code or cause denial of service. Any application using vulnerable SQLite versions is affected.
💻 Affected Systems
- SQLite
- Applications embedding SQLite
- Siemens products
- FreeBSD
- Gentoo Linux
- NetApp products
- Oracle products
📦 What is this software?
Communications Network Charging And Control by Oracle
View all CVEs affecting Communications Network Charging And Control →
Communications Network Charging And Control by Oracle
View all CVEs affecting Communications Network Charging And Control →
Communications Network Charging And Control by Oracle
View all CVEs affecting Communications Network Charging And Control →
Hyperion Infrastructure Technology by Oracle
View all CVEs affecting Hyperion Infrastructure Technology →
Mysql by Oracle
Ontap Select Deploy Administration Utility by Netapp
View all CVEs affecting Ontap Select Deploy Administration Utility →
Sinec Infrastructure Network Services by Siemens
View all CVEs affecting Sinec Infrastructure Network Services →
Sqlite by Sqlite
Tenable.sc by Tenable
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Application crash causing denial of service, potentially with memory corruption that could lead to information disclosure.
If Mitigated
Limited impact if proper input validation and sandboxing prevent malicious SQL execution.
🎯 Exploit Status
Exploitation requires the ability to execute SQL queries against a vulnerable SQLite instance. The vulnerability is in SQL parsing/execution.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: SQLite 3.32.0 and later
Vendor Advisory: https://www.sqlite.org/releaselog/3_32_0.html
Restart Required: Yes
Instructions:
1. Update SQLite to version 3.32.0 or later. 2. For embedded applications, update the SQLite library. 3. Restart applications/services using SQLite. 4. For OS distributions, apply security updates from your vendor.
🔧 Temporary Workarounds
Input Validation
allValidate and sanitize all SQL input to prevent malicious ALTER TABLE queries with compound SELECT statements.
SQLite Compile-Time Options
linuxCompile SQLite with security hardening options like SQLITE_DEFAULT_MEMSTATUS=0 and SQLITE_MAX_ATTACHED=0.
./configure CFLAGS="-DSQLITE_DEFAULT_MEMSTATUS=0 -DSQLITE_MAX_ATTACHED=0"
🧯 If You Can't Patch
- Implement strict input validation to block ALTER TABLE queries with compound SELECT ORDER BY clauses.
- Use application-level sandboxing or privilege separation to limit SQLite's access to system resources.
🔍 How to Verify
Check if Vulnerable:
Check SQLite version with 'sqlite3 --version' or query 'SELECT sqlite_version();' from within SQLite.Check Version:
sqlite3 --versionVerify Fix Applied:
Confirm version is 3.32.0 or higher using the same version check methods.📡 Detection & Monitoring
Log Indicators:
- SQL syntax errors related to ALTER TABLE
- Application crashes with memory corruption signatures
- Unusual SQL query patterns with compound SELECT and ORDER BY
Network Indicators:
- Unexpected database connection attempts
- SQL injection attack patterns
SIEM Query:
source="application.log" AND ("ALTER TABLE" AND "ORDER BY" AND "SELECT")🔗 References
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://security.FreeBSD.org/advisories/FreeBSD-SA-20:22.sqlite.asc
- https://security.gentoo.org/glsa/202007-26
- https://security.netapp.com/advisory/ntap-20200416-0001/
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.sqlite.org/src/info/d09f8c3621d5f7f8
- https://www.tenable.com/security/tns-2021-14
- https://www3.sqlite.org/cgi/src/info/b64674919f673602
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://security.FreeBSD.org/advisories/FreeBSD-SA-20:22.sqlite.asc
- https://security.gentoo.org/glsa/202007-26
- https://security.netapp.com/advisory/ntap-20200416-0001/
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.sqlite.org/src/info/d09f8c3621d5f7f8
- https://www.tenable.com/security/tns-2021-14
- https://www3.sqlite.org/cgi/src/info/b64674919f673602
