CVE-2021-44492

Vulnerability

The vulnerability exists in the function f_incr in sr_port/f_incr.c of YottaDB (through r1.32) and FIS GT.M (through V7.0-000). When the function receives crafted input, it incorrectly initializes a type, leading to a NULL pointer dereference. The issue was discovered through fuzz testing as part of YottaDB’s efforts to improve robustness [2].

Exploitation

An attacker can exploit this vulnerability by providing specially crafted input to the database system. No authentication or special privileges are required if the attacker can send data that reaches the vulnerable function. The exact vector depends on the deployment, but any network or local interface that feeds input to the database could be used.

Impact

Successful exploitation causes a crash due to a NULL pointer dereference, resulting in a denial of service. There is no evidence of code execution or data compromise from this vulnerability.

Mitigation

For YottaDB, the fix is included in the r1.34 release, which addressed 40 bugs found via fuzz testing [2]. For FIS GT.M, no specific fix version is mentioned in the available references; users should monitor vendor updates. There is no known workaround.