Turning a 22-year-old Postgres type-confusion primitive into RCE

igbanam

Thanks for actually sharing your path to the zero-day. The context and story helps

NeuraCryption

Is this exploitable? If it is, this is very serious and if this is an unpatched disclosure millions of Businesses around the world will be affected.

sailfast

Amazing write-up. A great look at DB internals and your thought process.

jmuguy

I would call this more of a privilege escalation attack than RCE.

logophobia

Correct me if I'm wrong, but those all look like sql exploits. Don't those already require some sort of authenticated remote access. They are security issues, but calling them remote code exploitation make them seem more dangerous than they are. These seem more like privilege escalation, you have access through a database account and use that to gain full access to the whole server. So an issue for multi-tenant databases mostly.

amluto

Wow, in my mind this is beyond “code smell” and into code reek! According to the article, Postgres has an internal Datum that might be a pointer or not a pointer. Okay, this is already a bit risky. Datum comes along with a small-integer type id. That id is stored separately, presumably for efficiency? Maybe you have lots of Datums and one id and you do this for efficiency. Okay, as long as there is a clear story for why the id stays correctly bound to the datum. The “internal” thing where a bogus AST will cause type confusion makes me think the story here isn’t great. But then I learn that the type id is something that the code looks up in a system table in the database . I’m speechless. This is the kind of thing that can’t be represented in any safe language because the indication of whether a value is a pointer isn’t even in application memory. Eww. Maybe the AIs can exhaustively enumerate every code path that might get it wrong and rule them all out in a particular release. Maybe there’s even a Lean program that can verify it. But this is still the kind of design that is wrong by construction and is only okay if every single detail avoids the giant foot-cannon.

feralcortex

The age isn't the surprising part. What's interesting is that the bug lived in a code path that needs specific privileges or an extension to reach, which is exactly the kind of path fuzzing harnesses skip because they target the parser and the wire protocol. Most of these "decades-old" findings sit in reachable-but-unfuzzed middle layers, not in the hot paths.

nikeee

So apparently, we got an RCE in every layer of the entire LAMP stack in like a month? Yes, M is not Postgres here, but I guess MySQL/MariaDB will follow soon.