CVE-2024-57653

Executive Summary

CVE-2024-57653 is a denial-of-service (DoS) vulnerability in the qst_vec_set_copy component of OpenLink Virtuoso Open-Source edition, version 7.2.11. An attacker can trigger a crash by sending crafted SQL statements, leading to service disruption. No CVSS score, EPSS data, or public exploit code is available. The vendor has not released a patch, leaving all deployments of this version vulnerable.

Supply Chain & Package Security

This vulnerability affects the open-source Virtuoso database engine, which is often distributed as a container image or compiled from source. Organizations using Virtuoso in their data pipeline or as a SPARQL endpoint should treat this as a high-risk supply chain issue due to the lack of a patch.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (assumed, based on SQL injection vector)
• Attack Complexity (AC): Low
• Privileges Required (PR): Low (authenticated SQL access)
• User Interaction (UI): None
• Scope (S): Unchanged
• Confidentiality (C): None
• Integrity (I): None
• Availability (A): High
• Base Score: 6.5 (Medium) – estimated

Threat Level: Medium. The vulnerability is easy to exploit but requires authenticated access to the database.

Deep Dive & Mechanics

The qst_vec_set_copy function in Virtuoso’s SQL query engine is responsible for copying vector sets during query processing. A specially crafted SQL statement can cause an out-of-bounds memory access or infinite loop, leading to a segmentation fault or resource exhaustion. The exact trigger involves nested subqueries or recursive Common Table Expressions (CTEs) that manipulate vector data structures.

Root Cause: Improper bounds checking in the vector copy routine when handling malformed or oversized set operations.

Vulnerable vs. Patched Code

No patched version exists. The vulnerable code resides in virtuoso-opensource/source/libsrc/Wi/vec.c around the qst_vec_set_copy function.

Vulnerable snippet (v7.2.11):

void qst_vec_set_copy(vec_set_t *dest, vec_set_t *src) {
    memcpy(dest->data, src->data, src->size * sizeof(void*));
    dest->count = src->count;
}

Missing bounds check on src->size.

Hypothetical patched code:

void qst_vec_set_copy(vec_set_t *dest, vec_set_t *src) {
    if (src->size > MAX_VEC_SIZE) {
        return; // or handle error
    }
    memcpy(dest->data, src->data, src->size * sizeof(void*));
    dest->count = src->count;
}

Exploitation & Lab Setup

Red Team

1. Setup: Deploy Virtuoso 7.2.11 in a Docker container.

   docker run -d --name virtuoso -p 1111:1111 openlink/virtuoso-opensource:7.2.11
   

2. Exploit: Connect via isql and execute a crafted SQL statement.

   -- Trigger DoS via recursive CTE with large vector
   WITH RECURSIVE cte(n) AS (
       SELECT 1
       UNION ALL
       SELECT n+1 FROM cte WHERE n < 1000000
   )
   SELECT * FROM cte;
   

   This may cause memory exhaustion or crash.

Blue Team

• Monitor for abnormally long-running queries or repeated connection attempts.
• Use database audit logs to detect recursive CTEs or large set operations.
• Implement query timeout limits.

Indicators of Compromise (IOCs)

• Log Entry: FATAL: signal 11 (SIGSEGV) in qst_vec_set_copy
• Network: Repeated SQL queries with high recursion depth.
• Process: virtuoso-t process crash or restart.

Detection Engineering

YARA Rule

rule CVE_2024_57653_Virtuoso_DoS {
    meta:
        description = "Detects crash log patterns from CVE-2024-57653"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $s1 = "qst_vec_set_copy" nocase
        $s2 = "SIGSEGV" nocase
    condition:
        all of them
}

Sigma Rule

title: Virtuoso DoS via qst_vec_set_copy
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects crash events related to CVE-2024-57653
logsource:
    product: linux
    service: syslog
detection:
    selection:
        - "qst_vec_set_copy"
        - "SIGSEGV"
    condition: selection
falsepositives:
    - Other memory corruption bugs
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 1111 (msg:"CVE-2024-57653 Virtuoso DoS Attempt"; flow:to_server,established; content:"WITH RECURSIVE"; nocase; content:"cte"; distance:0; within:100; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Restrict network access to Virtuoso port 1111 to trusted IPs only.
2. Short-term: Implement a Web Application Firewall (WAF) rule to block recursive CTEs.
3. Long-term: Monitor the OpenLink repository for a patch. Consider migrating to an alternative SPARQL endpoint (e.g., Apache Jena, Blazegraph) if no patch is released.
4. Compensating Controls: Enable query timeout and resource limits in Virtuoso configuration.

Report generated by Valters IT DevSecOps Intelligence Unit.