Описание
Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a calculation derived from the value of an arbitrary 4-byte span of memory, via a chosen non-ctid input. While the calculation loses precision, substantial memory value recovery appears possible. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
A flaw was found in PostgreSQL. This vulnerability, stemming from a type confusion issue in the ctid data type selectivity estimator, could allow an authenticated object creator to access and potentially recover sensitive information from memory. By manipulating input, an attacker could gain unauthorized insight into system memory.
Отчет
An Important-rated information disclosure vulnerability in PostgreSQL allows an authenticated user with object creation privileges to read arbitrary memory spans. By exploiting a type confusion flaw within the ctid selectivity estimator, an attacker can view memory-derived calculations to recover sensitive data. Exploitation is limited to users possessing object creation rights
Меры по смягчению последствий
To mitigate this vulnerability, administrators should enforce the principle of least privilege by revoking CREATE permissions on all databases from untrusted users. Because exploiting this flaw strictly requires the attacker to be an object creator, removing this privilege effectively neutralizes the threat. Ensure only highly trusted administrative roles can create database objects
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | postgresql16 | Affected | ||
| Red Hat Enterprise Linux 10 | postgresql18 | Affected | ||
| Red Hat Enterprise Linux 6 | postgresql | Not affected | ||
| Red Hat Enterprise Linux 7 | postgresql | Not affected | ||
| Red Hat Enterprise Linux 8 | postgresql:12/postgresql | Affected | ||
| Red Hat Enterprise Linux 8 | postgresql:15/postgresql | Affected | ||
| Red Hat Enterprise Linux 8 | postgresql:16/postgresql | Affected | ||
| Red Hat Enterprise Linux 9 | postgresql | Affected | ||
| Red Hat Enterprise Linux 9 | postgresql:15/postgresql | Affected | ||
| Red Hat Enterprise Linux 9 | postgresql:16/postgresql | Affected |
Показывать по
Дополнительная информация
Статус:
8.1 High
CVSS3
Связанные уязвимости
Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a calculation derived from the value of an arbitrary 4-byte span of memory, via a chosen non-ctid input. While the calculation loses precision, substantial memory value recovery appears possible. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a calculation derived from the value of an arbitrary 4-byte span of memory, via a chosen non-ctid input. While the calculation loses precision, substantial memory value recovery appears possible. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
PostgreSQL ctid type confusion in selectivity estimator discloses derivative of arbitrary read
Type confusion regarding input of PostgreSQL ctid data type selectivit ...
Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a calculation derived from the value of an arbitrary 4-byte span of memory, via a chosen non-ctid input. While the calculation loses precision, substantial memory value recovery appears possible. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
8.1 High
CVSS3