agora inbox for pgsql-committers@postgresql.org
help / color / mirror / Atom feedFrom: Noah Misch <noah@leadboat.com>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: Empty search_path in amcheck.
Date: Mon, 10 Aug 2026 13:41:29 +0000
Message-ID: <E1wtQFt-00000000yGu-2f1d@gemulon.postgresql.org> (raw)
Empty search_path in amcheck.
A grantee of amcheck function EXECUTE privilege could execute arbitrary
functions as the owners of expression indexes that depend on the search
path. An expression like (lower(col)) was not vulnerable, because
lower() is resolved at CREATE INDEX time. However, an expression
calling an sql-language or plpgsql-language function often was
vulnerable, even if it used search_path only to find objects in
pg_catalog. The amcheck documentation has been warning about data
disclosure after such a GRANT, not about function execution.
This might cause new amcheck errors when index expressions rely on a
broader search_path. Such indexes have seen errors during auto-analyze
since CVE-2018-1058 commit 582edc369cdbd348d68441fc50fa26a84afd0c1a, and
v17 amcheck always worked this way. Hence, the risk is low.
Leave a comment on the one other sandbox entrance that doesn't empty
search_path. In its case, the choice was valid.
Back-patch to v14 (all supported versions), but v17 was safe already.
Commit 2af07e2f749a9208ca1ed84fa1d8fe0e75833288 (v17) unintentionally
blocked the attack, and commit d70b17636ddf1ea2c71d1c7bc477372b36ccb66b
(v18) unintentionally removed that protection. Hence, this adds to v17
just a test and a comment. While emptying search_path became more
widespread in commit 2af07e2f749a9208ca1ed84fa1d8fe0e75833288 (v17),
none of its other changes blocked an attack available in v16, even when
considering GRANT. For example, brin_summarize_range() has had an owner
check that GRANT does not override.
Reported-by: 王跃林 <violin0613@tju.edu.cn>
Reported-by: Jacob Brazeal <jacob.brazeal@gmail.com>
Backpatch-through: 14
Security: CVE-2026-14673
Branch
------
REL_16_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/2cc14731825ec94017a3717e510f1f6780160c8a
Modified Files
--------------
contrib/amcheck/expected/check_btree.out | 17 +++++++++++++++--
contrib/amcheck/sql/check_btree.sql | 18 +++++++++++++++---
contrib/amcheck/verify_nbtree.c | 2 ++
src/backend/utils/init/usercontext.c | 6 ++++++
4 files changed, 38 insertions(+), 5 deletions(-)
view thread (5+ messages)
Message-ID: <E1wtQFt-00000000yGu-2f1d@gemulon.postgresql.org>
Permalink: ../E1wtQFt-00000000yGu-2f1d@gemulon.postgresql.org/
Also on: postgresql.org/message-id/E1wtQFt-00000000yGu-2f1d@gemulon.postgresql.org
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: noah@leadboat.com, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Empty search_path in amcheck.
In-Reply-To: <E1wtQFt-00000000yGu-2f1d@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox