CVE-2021-44497

Vulnerability

The vulnerability exists in FIS GT.M (and the related YottaDB code base) up to version V7.0-000. Crafted input can cause miscalculation of a for-loop's bounds, leading to a use-after-free condition when a pointer is pushed into previously freed memory.

Exploitation

An attacker can exploit this by providing specially crafted input to the database engine. No authentication or special privileges are required if the attacker can supply input to the affected code path. The miscalculated loop bounds cause the program to write a pointer into memory that has already been freed.

Impact

Successful exploitation results in a use-after-free condition, which can lead to memory corruption, potential arbitrary code execution, or denial of service. The attacker may gain control over the execution flow depending on the memory layout.

Mitigation

The issue was addressed in the YottaDB r1.34 release as part of fixes for bugs exposed by fuzz testing [2]. Users of FIS GT.M should upgrade to a version beyond V7.0-000 if a fix is available, or apply the corresponding patch from YottaDB. No workaround is documented.