22-Year-Old PostgreSQL Bug Turned into Remote Code Execution

A security researcher has discovered a 22-year-old vulnerability in the PostgreSQL database management system. According to the report, the researcher was able to turn this flaw into remote code execution (RCE). The vulnerability stems from a type confusion in how the database handles data types.

The researcher began investigating PostgreSQL's own data interpretation while working on a separate exploit for the pg_clickhouse extension. According to the blog post, placing a value inside a composite type, changing the type of one of its fields, and then reading the value back triggers the type confusion. This leads to what the researcher calls one of the most reliable memory-corruption exploits they have seen.

Given PostgreSQL's widespread use, the discovery poses a significant risk. The details of how to exploit the vulnerability have not been publicly disclosed, but the researcher tells the full story in a blog post. According to the report, the earlier pg_clickhouse vulnerability was reported to the vendor and fixed in June.

The incident highlights the need for caution regarding the security of open-source databases. Organizations using PostgreSQL should closely monitor patches and keep their systems up to date.