agora inbox for pgsql-committers@postgresql.orghelp / color / mirror / Atom feed
pgsql: Cross-check the type of a portal running EXECUTE or FETCH. 5+ messages / 1 participants [nested] [flat]
* pgsql: Cross-check the type of a portal running EXECUTE or FETCH. @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 5+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Cross-check the type of a portal running EXECUTE or FETCH. When an EXECUTE or FETCH statement is executed, there are two portals: an outer portal that is created for the EXECUTE or FETCH statement itself, and an inner portal for the statement being executed on its behalf. Before this commit, nothing checked that these two portals agreed on the tuple descriptor of the rows being returned. This can be leveraged to disclose server memory contents and achieve arbitrary code execution. To prevent that, we can make use of an existing safety mechanism, added by Tom Lane in commit 2f48ede080f42b97b594fb14102c82ca1001b80c, which allows a tuplestore DestReceiver to be informed of the tupleDesc required by the caller, and which will cause an ERROR to occur if that doesn't match the tupleDesc of what emerges from the executor (modulo dropped columns, which aren't an issue in the case at hand). Reported-by: Ben Morris in collaboration with Claude and Anthropic Research Reported-by: Peter Geoghegan <pg@bowt.ie> Reviewed-by: Michael Paquier <michael@paquier.xyz> Security: CVE-2026-16239 Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/9e02e2e18224e284af99ab1b5818d7974db12426 Author: Robert Haas <rhaas@postgresql.org> Modified Files -------------- src/backend/tcop/pquery.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) ^ permalink raw reply [nested|flat] 5+ messages in thread
* pgsql: Cross-check the type of a portal running EXECUTE or FETCH. @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 5+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Cross-check the type of a portal running EXECUTE or FETCH. When an EXECUTE or FETCH statement is executed, there are two portals: an outer portal that is created for the EXECUTE or FETCH statement itself, and an inner portal for the statement being executed on its behalf. Before this commit, nothing checked that these two portals agreed on the tuple descriptor of the rows being returned. This can be leveraged to disclose server memory contents and achieve arbitrary code execution. To prevent that, we can make use of an existing safety mechanism, added by Tom Lane in commit 2f48ede080f42b97b594fb14102c82ca1001b80c, which allows a tuplestore DestReceiver to be informed of the tupleDesc required by the caller, and which will cause an ERROR to occur if that doesn't match the tupleDesc of what emerges from the executor (modulo dropped columns, which aren't an issue in the case at hand). Reported-by: Ben Morris in collaboration with Claude and Anthropic Research Reported-by: Peter Geoghegan <pg@bowt.ie> Reviewed-by: Michael Paquier <michael@paquier.xyz> Security: CVE-2026-16239 Branch ------ REL_19_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/64a65ead1235f50816a46d4eb66a8ffcba7d5cde Author: Robert Haas <rhaas@postgresql.org> Modified Files -------------- src/backend/tcop/pquery.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) ^ permalink raw reply [nested|flat] 5+ messages in thread
* pgsql: Cross-check the type of a portal running EXECUTE or FETCH. @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 5+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Cross-check the type of a portal running EXECUTE or FETCH. When an EXECUTE or FETCH statement is executed, there are two portals: an outer portal that is created for the EXECUTE or FETCH statement itself, and an inner portal for the statement being executed on its behalf. Before this commit, nothing checked that these two portals agreed on the tuple descriptor of the rows being returned. This can be leveraged to disclose server memory contents and achieve arbitrary code execution. To prevent that, we can make use of an existing safety mechanism, added by Tom Lane in commit 2f48ede080f42b97b594fb14102c82ca1001b80c, which allows a tuplestore DestReceiver to be informed of the tupleDesc required by the caller, and which will cause an ERROR to occur if that doesn't match the tupleDesc of what emerges from the executor (modulo dropped columns, which aren't an issue in the case at hand). Reported-by: Ben Morris in collaboration with Claude and Anthropic Research Reported-by: Peter Geoghegan <pg@bowt.ie> Reviewed-by: Michael Paquier <michael@paquier.xyz> Security: CVE-2026-16239 Branch ------ REL_18_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/37b8f3b0e05e85d4338f04c71caa156ba21d5015 Author: Robert Haas <rhaas@postgresql.org> Modified Files -------------- src/backend/tcop/pquery.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) ^ permalink raw reply [nested|flat] 5+ messages in thread
* pgsql: Cross-check the type of a portal running EXECUTE or FETCH. @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 5+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Cross-check the type of a portal running EXECUTE or FETCH. When an EXECUTE or FETCH statement is executed, there are two portals: an outer portal that is created for the EXECUTE or FETCH statement itself, and an inner portal for the statement being executed on its behalf. Before this commit, nothing checked that these two portals agreed on the tuple descriptor of the rows being returned. This can be leveraged to disclose server memory contents and achieve arbitrary code execution. To prevent that, we can make use of an existing safety mechanism, added by Tom Lane in commit 2f48ede080f42b97b594fb14102c82ca1001b80c, which allows a tuplestore DestReceiver to be informed of the tupleDesc required by the caller, and which will cause an ERROR to occur if that doesn't match the tupleDesc of what emerges from the executor (modulo dropped columns, which aren't an issue in the case at hand). Reported-by: Ben Morris in collaboration with Claude and Anthropic Research Reported-by: Peter Geoghegan <pg@bowt.ie> Reviewed-by: Michael Paquier <michael@paquier.xyz> Security: CVE-2026-16239 Branch ------ REL_17_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/60887d34818a517ee7a21ef4f7eb18d03e7d1f4a Author: Robert Haas <rhaas@postgresql.org> Modified Files -------------- src/backend/tcop/pquery.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) ^ permalink raw reply [nested|flat] 5+ messages in thread
* pgsql: Cross-check the type of a portal running EXECUTE or FETCH. @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 5+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Cross-check the type of a portal running EXECUTE or FETCH. When an EXECUTE or FETCH statement is executed, there are two portals: an outer portal that is created for the EXECUTE or FETCH statement itself, and an inner portal for the statement being executed on its behalf. Before this commit, nothing checked that these two portals agreed on the tuple descriptor of the rows being returned. This can be leveraged to disclose server memory contents and achieve arbitrary code execution. To prevent that, we can make use of an existing safety mechanism, added by Tom Lane in commit 2f48ede080f42b97b594fb14102c82ca1001b80c, which allows a tuplestore DestReceiver to be informed of the tupleDesc required by the caller, and which will cause an ERROR to occur if that doesn't match the tupleDesc of what emerges from the executor (modulo dropped columns, which aren't an issue in the case at hand). Reported-by: Ben Morris in collaboration with Claude and Anthropic Research Reported-by: Peter Geoghegan <pg@bowt.ie> Reviewed-by: Michael Paquier <michael@paquier.xyz> Security: CVE-2026-16239 Branch ------ REL_16_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/7d150b5c94ce04fbed318d75efec35c4fe4f6a92 Author: Robert Haas <rhaas@postgresql.org> Modified Files -------------- src/backend/tcop/pquery.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) ^ permalink raw reply [nested|flat] 5+ messages in thread
end of thread, other threads:[~2026-08-10 13:41 UTC | newest] Thread overview: 5+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2026-08-10 13:41 pgsql: Cross-check the type of a portal running EXECUTE or FETCH. Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: Cross-check the type of a portal running EXECUTE or FETCH. Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: Cross-check the type of a portal running EXECUTE or FETCH. Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: Cross-check the type of a portal running EXECUTE or FETCH. Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: Cross-check the type of a portal running EXECUTE or FETCH. Noah Misch <noah@leadboat.com>
This inbox is served by agora; see mirroring instructions for how to clone and mirror all data and code used for this inbox