CVE-2024-57654

Executive Summary

CVE-2024-57654 is a denial-of-service (DoS) vulnerability in the qst_vec_get_int64 component of OpenLink Virtuoso Open-Source edition version 7.2.11. An attacker can craft malicious SQL statements that, when processed by the vulnerable function, cause the database server to crash or become unresponsive. The vulnerability has a CVSS score of 0.0 (unscored) and an EPSS probability of 0.0%, indicating low exploitation activity in the wild. No public proof-of-concept code or exploit exists at this time. The vendor has not acknowledged or patched the issue.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unscored)
• Attack Vector: Network (likely)
• Attack Complexity: Low
• Privileges Required: Low (SQL query execution)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: High
• Threat Level: Medium (due to potential for service disruption)

Deep Dive & Mechanics

The vulnerability resides in the qst_vec_get_int64 function within the Virtuoso SQL query engine. This function is responsible for extracting 64-bit integer values from query vectors during SQL statement parsing and execution. A crafted SQL statement can trigger an out-of-bounds read, null pointer dereference, or infinite loop, leading to a segmentation fault or resource exhaustion.

The exact trigger mechanism is not publicly documented, but based on the component name, it likely involves passing an oversized or malformed integer array in a SQL query (e.g., via VECTOR or ARRAY constructs). The function fails to validate the length or bounds of the input vector, causing memory corruption.

Vulnerable vs. Patched Code

No patched version exists. The vulnerable code path is in virtuoso-opensource/source/libsrc/Wi/wi.c or similar. A hypothetical fix would add bounds checking before accessing vector elements:

// Vulnerable code (simplified)
int64 qst_vec_get_int64(Vector *vec, int index) {
    return vec->data[index]; // No bounds check
}

// Patched code (hypothetical)
int64 qst_vec_get_int64(Vector *vec, int index) {
    if (index < 0 || index >= vec->length) {
        return 0; // or raise error
    }
    return vec->data[index];
}

Exploitation & Lab Setup

Red Team

1. Setup: Deploy Virtuoso 7.2.11 in a Docker container.

   docker run -d --name virtuoso -p 8890:8890 openlink/virtuoso-opensource:7.2.11
   

2. Craft SQL Payload: Use isql or HTTP endpoint to send a malicious query.

   -- Example: Trigger DoS via oversized vector
   SELECT VECTOR(1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100);
   

3. Observe Crash: Monitor server logs for segmentation fault.

Blue Team

• Detection: Monitor for repeated SQL errors or crashes in Virtuoso logs (virtuoso.log).
• Mitigation: Restrict SQL query complexity via firewall rules or WAF. Limit user privileges to prevent arbitrary vector operations.
• Honeypot: Deploy a low-interaction honeypot mimicking Virtuoso to capture exploit attempts.

Indicators of Compromise (IOCs)

• Log Entries: [ERROR] qst_vec_get_int64: assertion failed or SIGSEGV in server logs.
• Network: Repeated SQL queries containing large VECTOR() or ARRAY() constructs.
• File: Core dump files (core.*) in the Virtuoso data directory.
• Process: Unexpected termination of virtuoso-t process.

Detection Engineering

YARA Rule

rule CVE_2024_57654_Virtuoso_DoS {
    meta:
        description = "Detects SQL queries targeting CVE-2024-57654 in Virtuoso logs"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $s1 = "qst_vec_get_int64" nocase
        $s2 = "SIGSEGV" nocase
        $s3 = "assertion failed" nocase
    condition:
        any of ($s1, $s2, $s3)
}

Sigma Rule

title: Virtuoso DoS via CVE-2024-57654
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential exploitation of CVE-2024-57654 in Virtuoso logs
logsource:
    product: virtuoso
    service: server
detection:
    selection:
        - EventID: "ERROR"
          Message|contains: "qst_vec_get_int64"
        - EventID: "CRASH"
          Message|contains: "SIGSEGV"
    condition: selection
falsepositives:
    - Legitimate large vector queries
level: high

Suricata Rule

alert tcp any any -> any 8890 (msg:"CVE-2024-57654 Virtuoso DoS Attempt"; flow:to_server,established; content:"VECTOR"; nocase; pcre:"/VECTOR\s*\([^)]{100,}\)/"; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Restrict network access to Virtuoso ports (8890, 1111). Use a Web Application Firewall (WAF) to block oversized SQL queries.
• Short-term: Monitor vendor for patches. Consider downgrading to a stable version if available.
• Long-term: Migrate to a supported database platform. Implement input validation for all SQL query parameters.

Valters IT