CVE-2024-7348 PostgreSQL relation replacement during pg_dump executes arbitrary SQL

High 8.8 Published 8 Aug 2024 Updated 22 Aug 2024

A race condition in pg_dump allows attackers to execute arbitrary SQL as the dumping user, potentially escalating privileges to superuser.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2024-7348?

CVE-2024-7348 is a high-severity vulnerability in Postgresql Postgresql, published on 8 Aug 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack requires waiting for pg_dump to start, but winning the race condition is trivial if the attacker retains an open transaction. Versions before PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected.

Weakness: CWE-367

Which versions are affected by CVE-2024-7348?

1 open source package ship an affected version, including postgresql. It affects 1 product.

Package	Affected	Fixed in
`postgresql` Bitnami	All versions	`12.20.0, 13.16.0, 14.13.0, 15.8.0, 16.4.0`

Linux distribution packages (39)

`pg_repack` AlmaLinux:8	All versions	`1.4.6-3.module_el8.6.0+2760+1746ec94`
`pg_repack` AlmaLinux:8	All versions	`1.4.6-3.module_el8.6.0+3095+ee60d910`
`pg_repack` AlmaLinux:8	All versions	`1.4.6-3.module_el8.9.0+3704+f1f917ce`
`pgaudit` AlmaLinux:8	All versions	`1.4.0-7.module_el8.9.0+3740+0e74851f.alma.1`
`pgaudit` AlmaLinux:8	All versions	`1.5.0-1.module_el8.6.0+2760+1746ec94`
`pgaudit` AlmaLinux:8	All versions	`1.5.0-1.module_el8.6.0+3095+ee60d910`
`postgres-decoderbufs` AlmaLinux:8	All versions	`0.10.0-2.module_el8.6.0+2760+1746ec94`
`postgres-decoderbufs` AlmaLinux:8	All versions	`0.10.0-2.module_el8.6.0+3095+ee60d910`
`postgres-decoderbufs` AlmaLinux:8	All versions	`0.10.0-2.module_el8.9.0+3704+f1f917ce`
`postgresql` AlmaLinux:8	All versions	`12.20-1.module_el8.10.0+3886+1dfe41d7`
`postgresql` AlmaLinux:8	All versions	`13.16-1.module_el8.10.0+3887+93e5d125`
`postgresql-contrib` AlmaLinux:8	All versions	`12.20-1.module_el8.10.0+3886+1dfe41d7`
`postgresql-contrib` AlmaLinux:8	All versions	`13.16-1.module_el8.10.0+3887+93e5d125`
`postgresql-docs` AlmaLinux:8	All versions	`12.20-1.module_el8.10.0+3886+1dfe41d7`
`postgresql-docs` AlmaLinux:8	All versions	`13.16-1.module_el8.10.0+3887+93e5d125`
`postgresql-plperl` AlmaLinux:8	All versions	`12.20-1.module_el8.10.0+3886+1dfe41d7`
`postgresql-plperl` AlmaLinux:8	All versions	`13.16-1.module_el8.10.0+3887+93e5d125`
`postgresql-plpython3` AlmaLinux:8	All versions	`12.20-1.module_el8.10.0+3886+1dfe41d7`
`postgresql-plpython3` AlmaLinux:8	All versions	`13.16-1.module_el8.10.0+3887+93e5d125`
`postgresql-pltcl` AlmaLinux:8	All versions	`12.20-1.module_el8.10.0+3886+1dfe41d7`
`postgresql-pltcl` AlmaLinux:8	All versions	`13.16-1.module_el8.10.0+3887+93e5d125`
`postgresql-server` AlmaLinux:8	All versions	`12.20-1.module_el8.10.0+3886+1dfe41d7`
`postgresql-server` AlmaLinux:8	All versions	`13.16-1.module_el8.10.0+3887+93e5d125`
`postgresql-server-devel` AlmaLinux:8	All versions	`12.20-1.module_el8.10.0+3886+1dfe41d7`
`postgresql-server-devel` AlmaLinux:8	All versions	`13.16-1.module_el8.10.0+3887+93e5d125`
`postgresql-static` AlmaLinux:8	All versions	`12.20-1.module_el8.10.0+3886+1dfe41d7`
`postgresql-static` AlmaLinux:8	All versions	`13.16-1.module_el8.10.0+3887+93e5d125`
`postgresql-test` AlmaLinux:8	All versions	`12.20-1.module_el8.10.0+3886+1dfe41d7`
`postgresql-test` AlmaLinux:8	All versions	`13.16-1.module_el8.10.0+3887+93e5d125`
`postgresql-test-rpm-macros` AlmaLinux:8	All versions	`12.20-1.module_el8.10.0+3886+1dfe41d7`
`postgresql-test-rpm-macros` AlmaLinux:8	All versions	`13.16-1.module_el8.10.0+3887+93e5d125`
`postgresql-upgrade` AlmaLinux:8	All versions	`12.20-1.module_el8.10.0+3886+1dfe41d7`
`postgresql-upgrade` AlmaLinux:8	All versions	`13.16-1.module_el8.10.0+3887+93e5d125`
`postgresql-upgrade-devel` AlmaLinux:8	All versions	`12.20-1.module_el8.10.0+3886+1dfe41d7`
`postgresql-upgrade-devel` AlmaLinux:8	All versions	`13.16-1.module_el8.10.0+3887+93e5d125`
`postgresql` AlmaLinux:9	All versions	`13.16-1.el9_4`
`postgresql-contrib` AlmaLinux:9	All versions	`13.16-1.el9_4`
`postgresql-docs` AlmaLinux:9	All versions	`13.16-1.el9_4`
`postgresql-plperl` AlmaLinux:9	All versions	`13.16-1.el9_4`

Products include Postgresql Postgresql.

How do I fix CVE-2024-7348?

Upgrade postgresql to a fixed version for your release line: 12.20.0, 13.16.0, 14.13.0 or 15.8.0.

Is CVE-2024-7348 being exploited?

There is no known exploitation of CVE-2024-7348 in the wild and no public exploit code.

All Postgresql Postgresql vulnerabilities

Sources

Also known as ALPINE-CVE-2024-7348, ALSA-2024:5999, ALSA-2024:6000, ALSA-2024:6018, AZL-47636, AZL-47690 and 58 more.