Bug 2247170 (CVE-2023-5870) - CVE-2023-5870 postgresql: Role pg_signal_backend can signal certain superuser processes.
Summary: CVE-2023-5870 postgresql: Role pg_signal_backend can signal certain superuser...
Keywords:
Status: NEW
Alias: CVE-2023-5870
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2248842 2248844 2249041 2249042 2249043 2249044 2249045 2249046 2249777
Blocks: 2247166
TreeView+ depends on / blocked
 
Reported: 2023-10-31 04:13 UTC by Avinash Hanwate
Modified: 2024-04-03 08:15 UTC (History)
18 users (show)

Fixed In Version: PostgreSQL 16.1, PostgreSQL 15.5, PostgreSQL 14.10, PostgreSQL 13.13, PostgreSQL 12.17, PostgreSQL 11.22
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Successful exploitation requires a non-core extension with a less-resilient background worker and would affect that specific background worker only. This issue may allow a remote high privileged user to launch a denial of service (DoS) attack.
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2023:7618 0 None None None 2023-11-30 16:04:13 UTC
Red Hat Product Errata RHBA-2023:7774 0 None None None 2023-12-13 09:52:06 UTC
Red Hat Product Errata RHBA-2023:7779 0 None None None 2023-12-13 14:34:46 UTC
Red Hat Product Errata RHBA-2024:0031 0 None None None 2024-01-02 13:43:42 UTC
Red Hat Product Errata RHBA-2024:0063 0 None None None 2024-01-04 07:36:06 UTC
Red Hat Product Errata RHBA-2024:0099 0 None None None 2024-01-09 16:22:54 UTC
Red Hat Product Errata RHBA-2024:0109 0 None None None 2024-01-10 08:29:48 UTC
Red Hat Product Errata RHSA-2023:7545 0 None None None 2023-11-28 15:08:36 UTC
Red Hat Product Errata RHSA-2023:7579 0 None None None 2023-11-29 14:07:22 UTC
Red Hat Product Errata RHSA-2023:7580 0 None None None 2023-11-29 14:10:18 UTC
Red Hat Product Errata RHSA-2023:7581 0 None None None 2023-11-29 14:11:41 UTC
Red Hat Product Errata RHSA-2023:7616 0 None None None 2023-11-30 14:57:07 UTC
Red Hat Product Errata RHSA-2023:7656 0 None None None 2023-12-05 16:03:44 UTC
Red Hat Product Errata RHSA-2023:7666 0 None None None 2023-12-06 09:48:19 UTC
Red Hat Product Errata RHSA-2023:7667 0 None None None 2023-12-06 09:47:26 UTC
Red Hat Product Errata RHSA-2023:7694 0 None None None 2023-12-07 08:20:38 UTC
Red Hat Product Errata RHSA-2023:7695 0 None None None 2023-12-07 08:20:58 UTC
Red Hat Product Errata RHSA-2023:7714 0 None None None 2023-12-11 09:49:28 UTC
Red Hat Product Errata RHSA-2023:7770 0 None None None 2023-12-13 08:02:16 UTC
Red Hat Product Errata RHSA-2023:7772 0 None None None 2023-12-13 08:02:56 UTC
Red Hat Product Errata RHSA-2023:7784 0 None None None 2023-12-13 15:31:13 UTC
Red Hat Product Errata RHSA-2023:7785 0 None None None 2023-12-13 15:31:34 UTC
Red Hat Product Errata RHSA-2023:7883 0 None None None 2023-12-20 10:50:26 UTC
Red Hat Product Errata RHSA-2023:7884 0 None None None 2023-12-20 10:50:38 UTC
Red Hat Product Errata RHSA-2023:7885 0 None None None 2023-12-20 10:50:13 UTC
Red Hat Product Errata RHSA-2024:0304 0 None None None 2024-01-18 20:42:04 UTC
Red Hat Product Errata RHSA-2024:0332 0 None None None 2024-01-22 18:54:27 UTC
Red Hat Product Errata RHSA-2024:0337 0 None None None 2024-01-22 20:55:24 UTC

Description Avinash Hanwate 2023-10-31 04:13:38 UTC
The documentation says the pg_signal_backend role cannot signal "a backend owned by a superuser".  On the contrary, it can signal background workers, including the logical replication launcher.  It can signal autovacuum workers and the autovacuum launcher.  Signaling autovacuum workers and those two launchers provides no meaningful exploit, so exploiting this vulnerability requires a non-core extension with a less-resilient background worker.  For example, a non-core background worker that does not auto-restart would experience a denial of service with respect to that particular background worker.

The PostgreSQL project thanks Hemanth Sandrana and Mahendrakar Srinivasarao for reporting this problem.

Comment 13 TEJ RATHI 2023-11-10 10:22:32 UTC
This CVE is public now (lifting embargo...)
https://www.postgresql.org/about/news/postgresql-161-155-1410-1313-1217-and-1122-released-2749/

Comment 14 TEJ RATHI 2023-11-10 11:24:02 UTC
Created mingw-postgresql tracking bugs for this issue:

Affects: fedora-all [bug 2249042]


Created postgresql tracking bugs for this issue:

Affects: fedora-all [bug 2249041]


Created postgresql:12/postgresql tracking bugs for this issue:

Affects: fedora-all [bug 2249043]


Created postgresql:13/postgresql tracking bugs for this issue:

Affects: fedora-all [bug 2249044]


Created postgresql:14/postgresql tracking bugs for this issue:

Affects: fedora-all [bug 2249045]


Created postgresql:15/postgresql tracking bugs for this issue:

Affects: fedora-all [bug 2249046]

Comment 17 errata-xmlrpc 2023-11-28 15:08:34 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2023:7545 https://access.redhat.com/errata/RHSA-2023:7545

Comment 18 errata-xmlrpc 2023-11-29 14:07:21 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2023:7579 https://access.redhat.com/errata/RHSA-2023:7579

Comment 19 errata-xmlrpc 2023-11-29 14:10:17 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2023:7580 https://access.redhat.com/errata/RHSA-2023:7580

Comment 20 errata-xmlrpc 2023-11-29 14:11:39 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:7581 https://access.redhat.com/errata/RHSA-2023:7581

Comment 21 errata-xmlrpc 2023-11-30 14:57:06 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2023:7616 https://access.redhat.com/errata/RHSA-2023:7616

Comment 23 errata-xmlrpc 2023-12-05 16:03:43 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2023:7656 https://access.redhat.com/errata/RHSA-2023:7656

Comment 24 errata-xmlrpc 2023-12-06 09:47:24 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Advanced Update Support
  Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.2 Telecommunications Update Service

Via RHSA-2023:7667 https://access.redhat.com/errata/RHSA-2023:7667

Comment 25 errata-xmlrpc 2023-12-06 09:48:17 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2023:7666 https://access.redhat.com/errata/RHSA-2023:7666

Comment 26 errata-xmlrpc 2023-12-07 08:20:36 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.4 Telecommunications Update Service

Via RHSA-2023:7694 https://access.redhat.com/errata/RHSA-2023:7694

Comment 27 errata-xmlrpc 2023-12-07 08:20:57 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.4 Telecommunications Update Service

Via RHSA-2023:7695 https://access.redhat.com/errata/RHSA-2023:7695

Comment 28 errata-xmlrpc 2023-12-11 09:49:26 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:7714 https://access.redhat.com/errata/RHSA-2023:7714

Comment 29 errata-xmlrpc 2023-12-13 08:02:15 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7

Via RHSA-2023:7770 https://access.redhat.com/errata/RHSA-2023:7770

Comment 30 errata-xmlrpc 2023-12-13 08:02:54 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7

Via RHSA-2023:7772 https://access.redhat.com/errata/RHSA-2023:7772

Comment 31 errata-xmlrpc 2023-12-13 15:31:11 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:7784 https://access.redhat.com/errata/RHSA-2023:7784

Comment 32 errata-xmlrpc 2023-12-13 15:31:33 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:7785 https://access.redhat.com/errata/RHSA-2023:7785

Comment 33 errata-xmlrpc 2023-12-20 10:50:11 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2023:7885 https://access.redhat.com/errata/RHSA-2023:7885

Comment 34 errata-xmlrpc 2023-12-20 10:50:25 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2023:7883 https://access.redhat.com/errata/RHSA-2023:7883

Comment 35 errata-xmlrpc 2023-12-20 10:50:36 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:7884 https://access.redhat.com/errata/RHSA-2023:7884

Comment 37 errata-xmlrpc 2024-01-18 20:42:02 UTC
This issue has been addressed in the following products:

  RHACS-3.74-RHEL-8

Via RHSA-2024:0304 https://access.redhat.com/errata/RHSA-2024:0304

Comment 38 errata-xmlrpc 2024-01-22 18:54:25 UTC
This issue has been addressed in the following products:

  RHACS-4.1-RHEL-8

Via RHSA-2024:0332 https://access.redhat.com/errata/RHSA-2024:0332

Comment 39 errata-xmlrpc 2024-01-22 20:55:23 UTC
This issue has been addressed in the following products:

  Red Hat Advanced Cluster Security 4.2

Via RHSA-2024:0337 https://access.redhat.com/errata/RHSA-2024:0337


Note You need to log in before you can comment on or make changes to this bug.