CVE-2017-12172 Privilege escalation in postgresql
Database superusers can escalate to root privileges by exploiting symbolic link vulnerabilities in packager-authored startup scripts that run as root.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-12172?
CVE-2017-12172 is a medium-severity vulnerability in Postgresql Postgresql, published on 22 Nov 2017. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20, and 9.2.x before 9.2.24 runs under a non-root operating system account, and database superusers have effective ability to run arbitrary code under that system account. PostgreSQL provides a script for starting the database server during system boot. Packages of PostgreSQL for many operating systems provide their own, packager-authored startup implementations. Several implementations use a log file name that the database superuser can replace with a symbolic link. As root, they open(), chmod() and/or chown() this log file name. This often suffices for the database superuser to escalate to root privileges when root starts the server.
Weakness: CWE-59
Which versions are affected by CVE-2017-12172?
It affects 1 product.
Products include Postgresql Postgresql.
How do I fix CVE-2017-12172?
Upgrade to a fixed version.
Is CVE-2017-12172 being exploited?
There is no known exploitation of CVE-2017-12172 in the wild and no public exploit code.
Other vulnerabilities in Postgresql Postgresql
Sources
Also known as GHSA-r936-w9vp-c53q.