CVE-2020-9327: 
SQLite vulnerability analysis and mitigation

In SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference and segmentation fault because of generated column optimizations (NVD, CVE). The vulnerability was discovered on February 16, 2020 and fixed on February 17, 2020.

The vulnerability occurs in the isAuxiliaryVtabOperator function when checking if a TK_COLUMN expression node references a virtual table. The code fails to verify that the Expr.y.pTab pointer is not null before accessing it, which can happen during generated column optimizations. This leads to a segmentation fault when the pointer is dereferenced (SQLite Commit).

A successful exploitation of this vulnerability could allow an attacker to cause a denial of service condition by triggering a segmentation fault in the SQLite database engine (Ubuntu).

The vulnerability was fixed in SQLite versions after 3.31.1. Users should upgrade to a patched version. The fix involves adding proper null pointer checks before accessing the table pointer in virtual table operations (SQLite Fix).