CVE-2021-43304

Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and especially the arbitrary copy operation wildCopy<copy_amount>(op, ip, copy_end), don’t exceed the destination buffer’s limits.

CVSS v3 8.8 HIGH
CVSS v2.0 6.5 MEDIUM

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://jfrog.com/blog/7-rce-and-dos-vulnerabilities-found-in-clickhouse-dbms	Exploit Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/11/msg00002.html	Mailing List Third Party Advisory
https://jfrog.com/blog/7-rce-and-dos-vulnerabilities-found-in-clickhouse-dbms	Exploit Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/11/msg00002.html	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:yandex:clickhouse:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-03-14 23:15

Updated : 2024-11-21 06:29

NVD link : CVE-2021-43304

Mitre link : CVE-2021-43304

CVE.ORG link : CVE-2021-43304

JSON object : View

Products Affected

yandex

clickhouse

debian

debian_linux

CWE

CWE-122

Heap-based Buffer Overflow

CWE-787

Out-of-bounds Write

{"id": "CVE-2021-43304", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2022-03-14T23:15:08.157", "references": [{"url": "https://jfrog.com/blog/7-rce-and-dos-vulnerabilities-found-in-clickhouse-dbms", "tags": ["Exploit", "Third Party Advisory"], "source": "reefs@jfrog.com"}, {"url": "https://lists.debian.org/debian-lts-announce/2022/11/msg00002.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "reefs@jfrog.com"}, {"url": "https://jfrog.com/blog/7-rce-and-dos-vulnerabilities-found-in-clickhouse-dbms", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.debian.org/debian-lts-announce/2022/11/msg00002.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "reefs@jfrog.com", "description": [{"lang": "en", "value": "CWE-122"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and especially the arbitrary copy operation wildCopy<copy_amount>(op, ip, copy_end), don\u2019t exceed the destination buffer\u2019s limits."}, {"lang": "es", "value": "Un Desbordamiento del b\u00fafer de la pila en el c\u00f3dec de compresi\u00f3n LZ4 de Clickhouse cuando es analizada una consulta maliciosa. No es verificado que las operaciones de copia en el bucle LZ4::decompressImpl y especialmente la operaci\u00f3n de copia arbitraria wildCopy(copy_amount)(op, ip, copy_end), no excedan los l\u00edmites del buffer de destino"}], "lastModified": "2024-11-21T06:29:02.700", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:yandex:clickhouse:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2C2ADE3F-47F5-4E18-8FC7-4194647F47C7", "versionEndExcluding": "21.10.2.15"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"}], "operator": "OR"}]}], "sourceIdentifier": "reefs@jfrog.com"}