CVE-2024-0232

What it actually does

Heap use-after-free in jsonParseAddNodeArray() within sqlite3.c triggered by specially crafted JSON input, resulting in application crash and denial of service.

Why it matters to the business

Applications relying on SQLite may experience unexpected crashes and temporary loss of service when handling untrusted input, disrupting operations dependent on database functionality.

How an attack unfolds

A local attacker supplies malicious JSON content to a victim application that invokes SQLite's JSON parsing routines; the use-after-free condition is triggered during node array construction in jsonParseAddNodeArray, causing the process to crash.

How to fix it

Upgrade SQLite to commit 43fa051ec7c5a7d89e1f5f541a5cd34d53e07422 or a later fixed revision in all affected installations.

How to confirm the fix worked

Confirm the running SQLite version incorporates the referenced commit, then exercise JSON parsing paths with known trigger inputs to verify absence of crashes.

Typical attack path

1. Craft malicious JSON payload designed to trigger the use-after-free in jsonParseAddNodeArray
2. Deliver the payload to the target application via local input mechanisms
3. Induce the application to parse the JSON using SQLite functions
4. Trigger heap corruption leading to denial of service crash

How to detect it

Monitor process logs and crash dumps for segmentation faults or aborts occurring during SQLite JSON parsing operations; correlate with application entry points that accept external data.

What your security team should do

• Apply the fixed SQLite commit across all environments immediately
• Audit applications and libraries for SQLite dependencies and prioritize updates
• Implement input validation or sandboxing around untrusted JSON processing where feasible