CVE-2021-44498

Vulnerability

An issue in FIS GT.M through V7.0-000 (and the related YottaDB code base) allows crafted input to cause incorrect type initialization in the f_incr function in sr_port/f_incr.c. This results in a NULL pointer dereference and a crash. The vulnerability was discovered through fuzz testing [2]. Affected versions include GT.M up to V7.0-000 [1] and YottaDB versions prior to the r1.34 release.

Exploitation

An attacker can trigger the vulnerability by providing specially crafted input to the database engine. No authentication or special privileges are required; the attacker only needs the ability to send or inject the malicious input into the system, potentially over a network or through a local interface.

Impact

Successful exploitation causes a denial of service (DoS) due to a crash from the NULL pointer dereference. No code execution or data corruption is indicated in the available references.

Mitigation

YottaDB has fixed this issue in release r1.34 [2]. For GT.M users, upgrading to a version beyond V7.0-000 is recommended if a patch is available; otherwise, no official fix has been announced for GT.M as of the publication date. Users should monitor vendor advisories for updates.