CoreCVE
Back

HIGH

PostgreSQL relation replacement during pg_dump executes arbitrary SQL

Published Aug 8, 2024

Description

Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack requires waiting for pg_dump to start, but winning the race condition is trivial if the attacker retains an open transaction. Versions before PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected.

Affected products

Remediation

Red Hat statement

Satellite PostgreSQL is pulled through a base layered OS product and/or appstream repository and it is not shipped through this offering. This TOCTOU race condition in pg_dump is a important severity issue because it enables a non-privileged database user to escalate their privileges and execute arbitrary SQL functions as the superuser, compromising the entire database system. The exploitation of this vulnerability is particularly dangerous due to the inherent privilege level associated with the pg_dump process, which typically operates with elevated rights to ensure comprehensive backups. The ease of exploitation—due to the trivial nature of winning the race condition by holding an open transaction—further amplifies the risk, making it a significant threat in environments running affected PostgreSQL versions.

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Weaknesses (1)

CWE-367

References (7)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner PostgreSQL
Published Aug 8, 2024
Updated Aug 22, 2024
Reserved Jul 31, 2024
Link CVE-2024-7348
CISA Vulnrichment
Updated Aug 9, 2024
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2024-7348
Red Hat
Severity Important
Public date Aug 8, 2024
Links CVE-2024-7348 - Bugzilla