From: Alexander Korotkov <akorotkov@postgresql.org>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: Avoid repeated table name lookups in createPartitionTable()
Date: Thu, 22 Aug 2024 06:56:14 +0000
Message-ID: <E1sh1jy-000tEJ-De@gemulon.postgresql.org> (raw)
Avoid repeated table name lookups in createPartitionTable()
Currently, createPartitionTable() opens newly created table using its name.
This approach is prone to privilege escalation attack, because we might end
up opening another table than we just created.
This commit address the issue above by opening newly created table by its
OID. It appears to be tricky to get a relation OID out of ProcessUtility().
We have to extend TableLikeClause with new newRelationOid field, which is
filled within ProcessUtility() to be further accessed by caller.
Security: CVE-2014-0062
Reported-by: Noah Misch
Discussion: https://postgr.es/m/20240808171351.a9.nmisch%40google.com
Reviewed-by: Pavel Borisov, Dmitry Koval
Branch
------
REL_17_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/f636ab41aba215eaa3303e21a10f12d81357f1f6
Modified Files
--------------
src/backend/commands/tablecmds.c | 3 ++-
src/backend/parser/gram.y | 1 +
src/backend/tcop/utility.c | 6 ++++++
src/include/nodes/parsenodes.h | 1 +
4 files changed, 10 insertions(+), 1 deletion(-)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: akorotkov@postgresql.org, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Avoid repeated table name lookups in createPartitionTable()
In-Reply-To: <E1sh1jy-000tEJ-De@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox