PostgreSQL Array Integer Overflow Allows Authenticated Code Exec
CVE-2023-5869 Published on December 10, 2023

Postgresql: buffer overrun from integer overflow in array modification
A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification. This issue exists due to an integer overflow during array modification where a remote user can trigger the overflow by providing specially crafted data. This enables the execution of arbitrary code on the target system, allowing users to write arbitrary bytes to memory and extensively read the server's memory.

Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory NVD

Vulnerability Analysis

CVE-2023-5869 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:

NETWORK

Attack Complexity:

LOW

Privileges Required:

LOW

User Interaction:

NONE

Scope:

UNCHANGED

Confidentiality Impact:

HIGH

Integrity Impact:

HIGH

Availability Impact:

HIGH

Timeline

2023-10-31

Reported to Red Hat.

2023-11-09

Made public. 9 days later.

Weakness Type

Integer Overflow or Wraparound

The software performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control. An integer overflow or wraparound occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may wrap to become a very small or negative number. While this may be intended behavior in circumstances that rely on wrapping, it can have security consequences if the wrap is unexpected. This is especially the case if the integer overflow can be triggered using user-supplied inputs. This becomes security-critical when the result is used to control looping, make a security decision, or determine the offset or size in behaviors such as memory allocation, copying, concatenation, etc.

Products Associated with CVE-2023-5869

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2023-5869 are published in these products:

Canonical Ubuntu Linux

PostgreSQL

Red Hat Enterprise Linux Desktop

Red Hat Enterprise Linux Workstation

Red Hat Enterprise Linux Scientific Computing

Red Hat Enterprise Linux Server

Red Hat Software Collections

Red Hat Enterprise Linux (RHEL)

Red Hat Enterprise Linux Server Tus

Red Hat Enterprise Linux Server Aus

Red Hat Enterprise Linux Eus

Red Hat Enterprise Linux For Arm 64

Red Hat Enterprise Linux Power Little Endian Eus

Red Hat Codeready Linux Builder Arm64 Eus

Red Hat Codeready Linux Builder Ibm Z Systems Eus

Red Hat Codeready Linux Builder Eus Power Little Endian Eus

Red Hat Codeready Linux Builder Eus

Red Hat Enterprise Linux Power Little Endian

Red Hat Enterprise Linux Ibm Z Systems Eus

Red Hat Enterprise Linux Ibm Z Systems

Red Hat Codeready Linux Builder Power Little Endian Eus

Red Hat Enterprise Linux Power Big Endian

Red Hat Advanced Cluster Security

Red Hat Rhel E4s

Red Hat Rhel Tus

Red Hat Rhel Aus

Red Hat Rhel Eus

Red Hat Rhel Software Collections