corona icon indicating copy to clipboard operation
corona copied to clipboard

Published 20 hours ago • verified publisher icon coronalabs

Bump up SQLite 3.41.2 to eliminate known vulnerabilities

Open clang-clang-clang opened this issue 1 year ago • 4 comments

According to the compatibility of SQLite, it should be easy to upgrade.

This PR affects Android/Windows/Linux/NXS. It has been test passed on Android/Windows, but requires testing on Linux/NXS.

Vulnerabilities

The following vulnerabilities were reported by partner, and cannot be detected by intel/cve-bin-tool since it cannot recognize SQLite, should be fixed:

  • CVE-2017-10989
  • CVE-2018-20346
  • CVE-2018-20505
  • CVE-2018-20506
  • CVE-2018-8740
  • CVE-2019-16168
  • CVE-2019-19645
  • CVE-2019-19646
  • CVE-2019-8457
  • CVE-2020-11655
  • CVE-2020-13434
  • CVE-2020-13435
  • CVE-2020-13630
  • CVE-2020-13631
  • CVE-2020-13632
  • CVE-2020-15358
  • CVE-2022-35737

However, Solar2D 3688 used SQLite version contains more vulnerabilities than the above.

Analysis

Solar2D 3688 implements SQLite through lsqlite3. Specifically, external/lsqlite3 is derived from lsqlite3 0.9.4 and includes Solar2D-specific modifications. The actual version of SQLite3 linked varies by platform:

  • Android/Windows/Linux/NXS uses SQLite 3.19.0 from external/sqlite3.
  • Apple uses the corresponding SDK (dylib) provided by Xcode, for example, 3.39.5 for Mac sim.

Changes

As the latest version of lsqlite 0.9.5 does not have any substantial differences from 0.9.4 in lsqlite.c, SQLite will be upgraded instead, and tested using lsqlite's tests.

This modification affects Android/Windows/Linux/NXS. Apple is not affected as the SQLite binary version used is not from external/sqlite3. (Linux is compiled through platform/linux/CMakeList.txt, while platform/linux/*.project references lsqlite3 contains sqlite3.c is different from snap)

Testing

Tested demo lsqlite_tests_on_solar2d.zip passed on Android/Windows produced consistent results before (SQLite 3.19.0) and after (SQLite 3.41.2) modification. (After a simple configuration of lunit, I still could not run the uni-test of lsqlite/test, so I did not add uni-test in the testing.)

I was unable to test on Linux since I do not have physical Ubuntu machines, and nested virtualization did not work on my virtual machine. I also do not have NXS devices or development permissions. So, @bakeinflash, can I ask you for help with testing?

Thank you.

clang-clang-clang avatar Mar 31 '23 10:03 clang-clang-clang

The NXS platform uses native sqlite3 lib, so no need for testing the patch on that platform.

On Fri, Mar 31, 2023 at 1:47 PM Jeremy @.***> wrote:

According to the compatibility https://www.sqlite.org/formatchng.html of SQLite, it should be easy to upgrade.

This PR affects Android/Windows/Linux/NXS. It has been test passed on Android/Windows, but requires testing on Linux/NXS. Vulnerabilities

The following vulnerabilities were reported by partner, and cannot be detected by intel/cve-bin-tool https://github.com/intel/cve-bin-tool since it cannot recognize SQLite, should be fixed:

However, Solar2D 3688 used SQLite version contains more vulnerabilities than the above. Analysis

Solar2D 3688 implements SQLite through lsqlite3 http://lua.sqlite.org/index.cgi/index. Specifically, external/lsqlite3 is derived from lsqlite3 0.9.4 and includes Solar2D-specific modifications. The actual version of SQLite3 linked varies by platform:

  • Android/Windows/Linux/NXS uses SQLite 3.19.0 from external/sqlite3.
  • Apple uses the corresponding SDK (dylib) provided by Xcode, for example, 3.39.5 for Mac sim.

Changes

As the latest version of lsqlite 0.9.5 does not have any substantial differences from 0.9.4 in lsqlite.c, SQLite will be upgraded instead, and tested using lsqlite's tests.

This modification affects Android/Windows/Linux/NXS. Apple is not affected as the SQLite binary version used is not from external/sqlite3. (Linux is compiled through platform/linux/CMakeList.txt, while platform/linux/*.project references lsqlite3 contains sqlite3.c is different from snap) Testing

Tested demo lsqlite_tests_on_solar2d.zip https://github.com/coronalabs/corona/files/11120950/lsqlite_tests_on_solar2d.zip passed on Android/Windows produced consistent results before (SQLite 3.19.0) and after (SQLite 3.41.2) modification. (After a simple configuration of lunit, I still could not run the uni-test of lsqlite/test, so I did not add uni-test in the testing.)

I was unable to test on Linux since I do not have physical Ubuntu machines, and nested virtualization did not work on my virtual machine. I also do not have NXS devices or development permissions. So, @bakeinflash https://github.com/bakeinflash, can I ask you for help with testing?

Thank you.

You can view, comment on, or merge this pull request online at:

https://github.com/coronalabs/corona/pull/540 Commit Summary

File Changes

(4 files https://github.com/coronalabs/corona/pull/540/files)

Patch Links:

  • https://github.com/coronalabs/corona/pull/540.patch
  • https://github.com/coronalabs/corona/pull/540.diff

— Reply to this email directly, view it on GitHub https://github.com/coronalabs/corona/pull/540, or unsubscribe https://github.com/notifications/unsubscribe-auth/ABI7FJF7IQBA574H3U3B4A3W62Y3FANCNFSM6AAAAAAWOPPYFU . You are receiving this because you were mentioned.Message ID: @.***>

bakeinflash avatar Mar 31 '23 11:03 bakeinflash

@Jeremy, why is nested virtualization required to test sqlite3 on Linux? I believe one can test it on an Ubuntu virtual machine under WMWare.

Message ID: @.***>

bakeinflash avatar Mar 31 '23 11:03 bakeinflash

@bakeinflash build linux through snap with LXD, seems LXD not work when I build on ubuntu VM, I will try it later. How do you compile the linux version locally? Is it directly cmake? I forgot to try...

clang-clang-clang avatar Mar 31 '23 11:03 clang-clang-clang

I use cmake for debugging.. Tested on Ubuntu22.. Works for me.

On Fri, Mar 31, 2023 at 2:43 PM Jeremy @.***> wrote:

@bakeinflash https://github.com/bakeinflash build linux through snap with LXD, seems LXD not work when I build on ubuntu VM, I will try it later. How do you compile the linux version locally? Is it directly cmake? I forgot to try...

— Reply to this email directly, view it on GitHub https://github.com/coronalabs/corona/pull/540#issuecomment-1491802037, or unsubscribe https://github.com/notifications/unsubscribe-auth/ABI7FJCFC5KB7V2P5DR6TCTW627OXANCNFSM6AAAAAAWOPPYFU . You are receiving this because you were mentioned.Message ID: @.***>

bakeinflash avatar Mar 31 '23 13:03 bakeinflash