pg.ddx.io pgsql-committers@postgresql.org mailing list archivehelp / color / mirror / Atom feed
pgsql: Ban role pg_signal_backend from more superuser backend types. 7+ messages / 1 participants [nested] [flat]
* pgsql: Ban role pg_signal_backend from more superuser backend types. @ 2023-11-06 14:17 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 7+ messages in thread From: Noah Misch @ 2023-11-06 14:17 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Ban role pg_signal_backend from more superuser backend types. Documentation says it cannot signal "a backend owned by a superuser". On the contrary, it could signal background workers, including the logical replication launcher. It could signal autovacuum workers and the autovacuum launcher. Block all that. Signaling autovacuum workers and those two launchers doesn't stall progress beyond what one could achieve other ways. If a cluster uses a non-core extension with a background worker that does not auto-restart, this could create a denial of service with respect to that background worker. A background worker with bugs in its code for responding to terminations or cancellations could experience those bugs at a time the pg_signal_backend member chooses. Back-patch to v11 (all supported versions). Reviewed by Jelte Fennema-Nio. Reported by Hemanth Sandrana and Mahendrakar Srinivasarao. Security: CVE-2023-5870 Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/3a9b18b3095366cd0c4305441d426d04572d88c1 Modified Files -------------- src/backend/storage/ipc/signalfuncs.c | 9 +++++++-- src/test/regress/expected/privileges.out | 18 ++++++++++++++++++ src/test/regress/sql/privileges.sql | 15 +++++++++++++++ 3 files changed, 40 insertions(+), 2 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
* pgsql: Ban role pg_signal_backend from more superuser backend types. @ 2023-11-06 14:17 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 7+ messages in thread From: Noah Misch @ 2023-11-06 14:17 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Ban role pg_signal_backend from more superuser backend types. Documentation says it cannot signal "a backend owned by a superuser". On the contrary, it could signal background workers, including the logical replication launcher. It could signal autovacuum workers and the autovacuum launcher. Block all that. Signaling autovacuum workers and those two launchers doesn't stall progress beyond what one could achieve other ways. If a cluster uses a non-core extension with a background worker that does not auto-restart, this could create a denial of service with respect to that background worker. A background worker with bugs in its code for responding to terminations or cancellations could experience those bugs at a time the pg_signal_backend member chooses. Back-patch to v11 (all supported versions). Reviewed by Jelte Fennema-Nio. Reported by Hemanth Sandrana and Mahendrakar Srinivasarao. Security: CVE-2023-5870 Branch ------ REL_16_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/78541273156c74ed20acdc141cf2f996098cd794 Modified Files -------------- src/backend/storage/ipc/signalfuncs.c | 9 +++++++-- src/test/regress/expected/privileges.out | 18 ++++++++++++++++++ src/test/regress/sql/privileges.sql | 15 +++++++++++++++ 3 files changed, 40 insertions(+), 2 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
* pgsql: Ban role pg_signal_backend from more superuser backend types. @ 2023-11-06 14:17 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 7+ messages in thread From: Noah Misch @ 2023-11-06 14:17 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Ban role pg_signal_backend from more superuser backend types. Documentation says it cannot signal "a backend owned by a superuser". On the contrary, it could signal background workers, including the logical replication launcher. It could signal autovacuum workers and the autovacuum launcher. Block all that. Signaling autovacuum workers and those two launchers doesn't stall progress beyond what one could achieve other ways. If a cluster uses a non-core extension with a background worker that does not auto-restart, this could create a denial of service with respect to that background worker. A background worker with bugs in its code for responding to terminations or cancellations could experience those bugs at a time the pg_signal_backend member chooses. Back-patch to v11 (all supported versions). Reviewed by Jelte Fennema-Nio. Reported by Hemanth Sandrana and Mahendrakar Srinivasarao. Security: CVE-2023-5870 Branch ------ REL_15_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/595c988c90024acdc56479d0a631a232a9d19e36 Modified Files -------------- src/backend/storage/ipc/signalfuncs.c | 9 +++++++-- src/test/regress/expected/privileges.out | 18 ++++++++++++++++++ src/test/regress/sql/privileges.sql | 15 +++++++++++++++ 3 files changed, 40 insertions(+), 2 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
* pgsql: Ban role pg_signal_backend from more superuser backend types. @ 2023-11-06 14:17 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 7+ messages in thread From: Noah Misch @ 2023-11-06 14:17 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Ban role pg_signal_backend from more superuser backend types. Documentation says it cannot signal "a backend owned by a superuser". On the contrary, it could signal background workers, including the logical replication launcher. It could signal autovacuum workers and the autovacuum launcher. Block all that. Signaling autovacuum workers and those two launchers doesn't stall progress beyond what one could achieve other ways. If a cluster uses a non-core extension with a background worker that does not auto-restart, this could create a denial of service with respect to that background worker. A background worker with bugs in its code for responding to terminations or cancellations could experience those bugs at a time the pg_signal_backend member chooses. Back-patch to v11 (all supported versions). Reviewed by Jelte Fennema-Nio. Reported by Hemanth Sandrana and Mahendrakar Srinivasarao. Security: CVE-2023-5870 Branch ------ REL_14_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/508acb901e31cf10fcac0ff9304d3d2d33bb2b2f Modified Files -------------- src/backend/storage/ipc/signalfuncs.c | 9 +++++++-- src/test/regress/expected/privileges.out | 18 ++++++++++++++++++ src/test/regress/sql/privileges.sql | 15 +++++++++++++++ 3 files changed, 40 insertions(+), 2 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
* pgsql: Ban role pg_signal_backend from more superuser backend types. @ 2023-11-06 14:17 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 7+ messages in thread From: Noah Misch @ 2023-11-06 14:17 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Ban role pg_signal_backend from more superuser backend types. Documentation says it cannot signal "a backend owned by a superuser". On the contrary, it could signal background workers, including the logical replication launcher. It could signal autovacuum workers and the autovacuum launcher. Block all that. Signaling autovacuum workers and those two launchers doesn't stall progress beyond what one could achieve other ways. If a cluster uses a non-core extension with a background worker that does not auto-restart, this could create a denial of service with respect to that background worker. A background worker with bugs in its code for responding to terminations or cancellations could experience those bugs at a time the pg_signal_backend member chooses. Back-patch to v11 (all supported versions). Reviewed by Jelte Fennema-Nio. Reported by Hemanth Sandrana and Mahendrakar Srinivasarao. Security: CVE-2023-5870 Branch ------ REL_13_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/28b609550af0f8e6e09e5af0d090eda331992ef5 Modified Files -------------- src/backend/storage/ipc/signalfuncs.c | 9 +++++++-- src/test/regress/expected/privileges.out | 18 ++++++++++++++++++ src/test/regress/sql/privileges.sql | 15 +++++++++++++++ 3 files changed, 40 insertions(+), 2 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
* pgsql: Ban role pg_signal_backend from more superuser backend types. @ 2023-11-06 14:17 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 7+ messages in thread From: Noah Misch @ 2023-11-06 14:17 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Ban role pg_signal_backend from more superuser backend types. Documentation says it cannot signal "a backend owned by a superuser". On the contrary, it could signal background workers, including the logical replication launcher. It could signal autovacuum workers and the autovacuum launcher. Block all that. Signaling autovacuum workers and those two launchers doesn't stall progress beyond what one could achieve other ways. If a cluster uses a non-core extension with a background worker that does not auto-restart, this could create a denial of service with respect to that background worker. A background worker with bugs in its code for responding to terminations or cancellations could experience those bugs at a time the pg_signal_backend member chooses. Back-patch to v11 (all supported versions). Reviewed by Jelte Fennema-Nio. Reported by Hemanth Sandrana and Mahendrakar Srinivasarao. Security: CVE-2023-5870 Branch ------ REL_12_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/2893f2f40cfc2a7f6bd64b566f97140f8a379dd9 Modified Files -------------- src/backend/storage/ipc/signalfuncs.c | 9 +++++++-- src/test/regress/expected/privileges.out | 18 ++++++++++++++++++ src/test/regress/sql/privileges.sql | 15 +++++++++++++++ 3 files changed, 40 insertions(+), 2 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
* pgsql: Ban role pg_signal_backend from more superuser backend types. @ 2023-11-06 14:17 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 7+ messages in thread From: Noah Misch @ 2023-11-06 14:17 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Ban role pg_signal_backend from more superuser backend types. Documentation says it cannot signal "a backend owned by a superuser". On the contrary, it could signal background workers, including the logical replication launcher. It could signal autovacuum workers and the autovacuum launcher. Block all that. Signaling autovacuum workers and those two launchers doesn't stall progress beyond what one could achieve other ways. If a cluster uses a non-core extension with a background worker that does not auto-restart, this could create a denial of service with respect to that background worker. A background worker with bugs in its code for responding to terminations or cancellations could experience those bugs at a time the pg_signal_backend member chooses. Back-patch to v11 (all supported versions). Reviewed by Jelte Fennema-Nio. Reported by Hemanth Sandrana and Mahendrakar Srinivasarao. Security: CVE-2023-5870 Branch ------ REL_11_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/e082734c8e78e6622a0422e612a870278721e83f Modified Files -------------- src/backend/utils/adt/misc.c | 9 +++++++-- src/test/regress/expected/privileges.out | 18 ++++++++++++++++++ src/test/regress/sql/privileges.sql | 15 +++++++++++++++ 3 files changed, 40 insertions(+), 2 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
end of thread, other threads:[~2023-11-06 14:17 UTC | newest] Thread overview: 7+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2023-11-06 14:17 pgsql: Ban role pg_signal_backend from more superuser backend types. Noah Misch <noah@leadboat.com> 2023-11-06 14:17 pgsql: Ban role pg_signal_backend from more superuser backend types. Noah Misch <noah@leadboat.com> 2023-11-06 14:17 pgsql: Ban role pg_signal_backend from more superuser backend types. Noah Misch <noah@leadboat.com> 2023-11-06 14:17 pgsql: Ban role pg_signal_backend from more superuser backend types. Noah Misch <noah@leadboat.com> 2023-11-06 14:17 pgsql: Ban role pg_signal_backend from more superuser backend types. Noah Misch <noah@leadboat.com> 2023-11-06 14:17 pgsql: Ban role pg_signal_backend from more superuser backend types. Noah Misch <noah@leadboat.com> 2023-11-06 14:17 pgsql: Ban role pg_signal_backend from more superuser backend types. Noah Misch <noah@leadboat.com>
This inbox is served by DDX for PostgreSQL; see mirroring instructions for how to clone and mirror all data and code used for this inbox