CVE-2024-57635

Executive Summary

CVE-2024-57635 is a denial-of-service (DoS) vulnerability in the chash_array component of OpenLink Virtuoso Open-Source version 7.2.11. An attacker can exploit this flaw by sending crafted SQL statements, causing the database server to crash or become unresponsive. The vulnerability resides in the chash_array function, which is used for hash array operations within the SQL engine. No public proof-of-concept (PoC) or patch is currently available, and the CVSS score is listed as 0.0 due to incomplete NVD data. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains for unpatched instances.

Supply Chain & Package Security

This vulnerability affects the OpenLink Virtuoso Open-Source package, which is distributed as source code and via package managers (e.g., Docker, Linux distributions). Organizations using Virtuoso in their supply chain should verify their version and apply any available patches or mitigations.

CVSS Breakdown & Threat Level

The NVD has not assigned a CVSS vector or score for this CVE. Based on the description, the vulnerability is likely exploitable remotely via SQL injection, leading to a denial of service. A reasonable estimate would be:

• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires ability to send SQL statements
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H)
• Estimated CVSS Score: 6.5 (Medium)

Threat Level: Medium – DoS attacks can disrupt operations but do not lead to data loss or system compromise.

Deep Dive & Mechanics

The chash_array component in Virtuoso is responsible for handling hash array operations in SQL queries. The vulnerability is triggered by specially crafted SQL statements that cause an infinite loop, memory exhaustion, or a crash in the chash_array function. The exact mechanism is not publicly documented, but it likely involves improper input validation or boundary checking when processing hash array parameters.

Attack Vector: An authenticated or unauthenticated user (depending on database configuration) sends a malicious SQL query that exploits the chash_array function. The query may contain nested or malformed hash array syntax that the parser cannot handle correctly.

Impact: The database server becomes unresponsive, requiring a restart. This can lead to service downtime for applications relying on Virtuoso.

Vulnerable vs. Patched Code

No patched version is available. The vulnerable code is in the chash_array function within the Virtuoso source code (likely in libsrc/Wi/chash_array.c or similar). The exact vulnerable code snippet is not publicly disclosed.

Vulnerable Code (hypothetical):

// Vulnerable: No bounds checking on input size
int chash_array_process(char *input) {
    while (*input) {
        // Process hash array elements
        input++;
    }
    return 0;
}

Patched Code (hypothetical):

// Patched: Added input validation and size limits
int chash_array_process(char *input, size_t max_size) {
    size_t processed = 0;
    while (*input && processed < max_size) {
        // Process hash array elements
        input++;
        processed++;
    }
    if (processed >= max_size) {
        return -1; // Error: input too large
    }
    return 0;
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Access to a Virtuoso server (e.g., http://target:8890/)
• Ability to send SQL queries (e.g., via SPARQL endpoint or SQL command line)

Exploit Steps:

1. Identify the Virtuoso version by sending a simple query:

   SELECT * FROM sys_dav_sys.dba.dba_sysinfo;
   

2. Craft a malicious SQL statement targeting chash_array. Example (hypothetical):

   SELECT chash_array('A' * 1000000);
   

3. Send the query repeatedly to cause resource exhaustion:

   for i in {1..100}; do
     curl -X POST "http://target:8890/sparql" -d "query=SELECT chash_array('A' * 1000000);"
   done
   

4. Monitor server availability. If the server crashes, the exploit is successful.

Note: No public exploit code is available. The above is a conceptual example.

Blue Team (Defense & Detection)

Mitigation Steps:

• Restrict network access to the Virtuoso server (firewall rules).
• Use a Web Application Firewall (WAF) to block suspicious SQL queries.
• Monitor for unusual query patterns (e.g., extremely long strings, repeated queries).
• Apply rate limiting to the SPARQL endpoint.

Detection:

• Enable detailed logging in Virtuoso (virtuoso.ini):

  [Parameters]
  LogFile = /var/log/virtuoso.log
  LogLevel = 3
  

• Monitor logs for errors related to chash_array:

  tail -f /var/log/virtuoso.log | grep -i "chash_array"
  

Indicators of Compromise (IOCs)

• Network: Repeated SQL queries containing chash_array with large or malformed arguments.
• Logs: Error messages like chash_array: out of memory or chash_array: invalid input.
• System: High CPU or memory usage by the virtuoso-t process.
• File: Temporary files in /tmp/ with large sizes (if memory exhaustion occurs).

Detection Engineering

YARA Rule

rule CVE_2024_57635_Virtuoso_DoS {
    meta:
        description = "Detects SQL queries targeting chash_array DoS vulnerability"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-57635"
    strings:
        $sql1 = "chash_array" ascii wide nocase
        $sql2 = "SELECT" ascii wide nocase
        $pattern = /SELECT.*chash_array/i
    condition:
        $pattern and (#sql1 > 5)  // Multiple occurrences indicate attack
}

Sigma Rule

title: CVE-2024-57635 Virtuoso chash_array DoS Attempt
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects SQL queries targeting chash_array DoS vulnerability
author: Valters IT
logsource:
    category: application
    product: virtuoso
detection:
    selection:
        Query|contains: 'chash_array'
    condition: selection
falsepositives:
    - Legitimate use of chash_array in normal queries
level: medium

Suricata Rule

alert tcp any any -> any 8890 (msg:"CVE-2024-57635 Virtuoso chash_array DoS Attempt"; flow:to_server,established; content:"chash_array"; nocase; pcre:"/SELECT.*chash_array/i"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the Virtuoso server from untrusted networks.
2. Monitor logs for suspicious queries.
3. Apply input validation at the application layer (e.g., limit query length).

Long-Term Fix:

• Wait for an official patch from OpenLink. Check their GitHub repository or mailing list for updates.
• Consider migrating to an alternative RDF store if Virtuoso is critical and unpatched.

Workaround:

• Disable the chash_array function if not needed (requires source code modification).
• Use a reverse proxy to filter SQL queries.

Valters IT signature: This report is generated for educational and defensive purposes. Unauthorized exploitation is illegal.