agora inbox for pgsql-committers@postgresql.org
help / color / mirror / Atom feedFrom: Noah Misch <noah@leadboat.com>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: Cross-check the type of a portal running EXECUTE or FETCH.
Date: Mon, 10 Aug 2026 13:41:27 +0000
Message-ID: <E1wtQFr-00000000yDe-3rH8@gemulon.postgresql.org> (raw)
Cross-check the type of a portal running EXECUTE or FETCH.
When an EXECUTE or FETCH statement is executed, there are two portals:
an outer portal that is created for the EXECUTE or FETCH statement itself,
and an inner portal for the statement being executed on its behalf.
Before this commit, nothing checked that these two portals agreed on
the tuple descriptor of the rows being returned. This can be leveraged
to disclose server memory contents and achieve arbitrary code execution.
To prevent that, we can make use of an existing safety mechanism,
added by Tom Lane in commit 2f48ede080f42b97b594fb14102c82ca1001b80c,
which allows a tuplestore DestReceiver to be informed of the tupleDesc
required by the caller, and which will cause an ERROR to occur if
that doesn't match the tupleDesc of what emerges from the executor
(modulo dropped columns, which aren't an issue in the case at hand).
Reported-by: Ben Morris in collaboration with Claude and Anthropic Research
Reported-by: Peter Geoghegan <pg@bowt.ie>
Reviewed-by: Michael Paquier <michael@paquier.xyz>
Security: CVE-2026-16239
Branch
------
REL_17_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/60887d34818a517ee7a21ef4f7eb18d03e7d1f4a
Author: Robert Haas <rhaas@postgresql.org>
Modified Files
--------------
src/backend/tcop/pquery.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
view thread (5+ messages) latest in thread
Message-ID: <E1wtQFr-00000000yDe-3rH8@gemulon.postgresql.org>
Permalink: ../E1wtQFr-00000000yDe-3rH8@gemulon.postgresql.org/
Also on: postgresql.org/message-id/E1wtQFr-00000000yDe-3rH8@gemulon.postgresql.org
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: noah@leadboat.com, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Cross-check the type of a portal running EXECUTE or FETCH.
In-Reply-To: <E1wtQFr-00000000yDe-3rH8@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox