Описание
TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read in the Dictionary compression reverse row iterator (tsl/src/compression/algorithms/dictionary.c). The forward path validates the decoded index; the reverse path uses an assertion compiled out of release builds, leaving the 64-bit Simple8b index unvalidated and the read offset attacker-controlled. Attackers with DML access to a physical compressed relation can store a crafted datum and run a reverse-order scan. With a pass-by-value column type the out-of-bounds Datum is returned to the client as a normal column value, disclosing backend memory including the shared buffer pool, which SQL access control does not cover.
A flaw was found in TimescaleDB. An out-of-bounds read vulnerability exists in the Dictionary compression reverse row iterator. Attackers with Data Manipulation Language (DML) access to a physical compressed database table can store specially crafted data. By performing a reverse-order scan, this allows them to read sensitive backend memory, including the shared buffer pool, leading to information disclosure.
Отчет
This vulnerability is rated as Important severity because an authenticated database user with data modification privileges can trigger an out-of-bounds read to disclose sensitive backend process memory or cause a denial of service. The flaw bypasses SQL table-level access controls by returning unvalidated memory from the PostgreSQL shared buffer pool to unauthorized clients during reverse scans on compressed tables. TimescaleDB is not distributed in Red Hat Enterprise Linux and is only packaged in community repositories such as Fedora and EPEL, meaning supported Red Hat core platform deployments are not directly exposed.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Дополнительная информация
Статус:
8.1 High
CVSS3
Связанные уязвимости
TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read in the Dictionary compression reverse row iterator (tsl/src/compression/algorithms/dictionary.c). The forward path validates the decoded index; the reverse path uses an assertion compiled out of release builds, leaving the 64-bit Simple8b index unvalidated and the read offset attacker-controlled. Attackers with DML access to a physical compressed relation can store a crafted datum and run a reverse-order scan. With a pass-by-value column type the out-of-bounds Datum is returned to the client as a normal column value, disclosing backend memory including the shared buffer pool, which SQL access control does not cover.
TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read in the Dictionary compression reverse row iterator (tsl/src/compression/algorithms/dictionary.c). The forward path validates the decoded index; the reverse path uses an assertion compiled out of release builds, leaving the 64-bit Simple8b index unvalidated and the read offset attacker-controlled. Attackers with DML access to a physical compressed relation can store a crafted datum and run a reverse-order scan. With a pass-by-value column type the out-of-bounds Datum is returned to the client as a normal column value, disclosing backend memory including the shared buffer pool, which SQL access control does not cover.
ALT-PU-2026-14227: package `postgresql17-timescaledb` update to version 2.29.2-alt1
ALT-PU-2026-14225: package `postgresql16-timescaledb` update to version 2.29.2-alt1
ALT-PU-2026-13998: package `postgresql16-timescaledb` update to version 2.29.2-alt1
8.1 High
CVSS3