Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitd541ce3

Browse files
committed
Run REFRESH MATERIALIZED VIEW CONCURRENTLY in right security context
The internal commands in REFRESH MATERIALIZED VIEW CONCURRENTLY arecorrectly executed in SECURITY_RESTRICTED_OPERATION mode, except forcreating the temporary "diff" table, because you cannot createtemporary tables in SRO mode. But creating the temporary "diff" tableis a pretty complex CTAS command that selects from another temporarytable created earlier in the command. If you can cajole that CTAScommand to execute code defined by the table owner, the table ownercan run code with the privileges of the user running the REFRESHcommand.The proof-of-concept reported to the security team relied on CREATERULE to convert the internally-built temp table to a view. That's notpossible since commitb23cd18, and I was not able to find adifferent way to turn the SELECT on the temp table into codeexecution, so as far as I know this is only exploitable in v15 andbelow. That's a fiddly assumption though, so apply this patch tomaster and all stable versions.Thanks to Pedro Gallegos for the report.Security:CVE-2023-5869Reviewed-by: Noah Misch
1 parentd8f732c commitd541ce3

File tree

1 file changed

+26
-7
lines changed

1 file changed

+26
-7
lines changed

‎src/backend/commands/matview.c

Lines changed: 26 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -644,13 +644,35 @@ refresh_by_match_merge(Oid matviewOid, Oid tempOid, Oid relowner,
644644
SPI_getvalue(SPI_tuptable->vals[0],SPI_tuptable->tupdesc,1))));
645645
}
646646

647+
/*
648+
* Create the temporary "diff" table.
649+
*
650+
* Temporarily switch out of the SECURITY_RESTRICTED_OPERATION context,
651+
* because you cannot create temp tables in SRO context. For extra
652+
* paranoia, add the composite type column only after switching back to
653+
* SRO context.
654+
*/
647655
SetUserIdAndSecContext(relowner,
648656
save_sec_context |SECURITY_LOCAL_USERID_CHANGE);
657+
resetStringInfo(&querybuf);
658+
appendStringInfo(&querybuf,
659+
"CREATE TEMP TABLE %s (tid pg_catalog.tid)",
660+
diffname);
661+
if (SPI_exec(querybuf.data,0)!=SPI_OK_UTILITY)
662+
elog(ERROR,"SPI_exec failed: %s",querybuf.data);
663+
SetUserIdAndSecContext(relowner,
664+
save_sec_context |SECURITY_RESTRICTED_OPERATION);
665+
resetStringInfo(&querybuf);
666+
appendStringInfo(&querybuf,
667+
"ALTER TABLE %s ADD COLUMN newdata %s",
668+
diffname,tempname);
669+
if (SPI_exec(querybuf.data,0)!=SPI_OK_UTILITY)
670+
elog(ERROR,"SPI_exec failed: %s",querybuf.data);
649671

650-
/* Start building the query forcreating the diff table. */
672+
/* Start building the query forpopulating the diff table. */
651673
resetStringInfo(&querybuf);
652674
appendStringInfo(&querybuf,
653-
"CREATE TEMP TABLE %s AS "
675+
"INSERT INTO %s "
654676
"SELECT mv.ctid AS tid, newdata.*::%s AS newdata "
655677
"FROM %s mv FULL JOIN %s newdata ON (",
656678
diffname,tempname,matviewname,tempname);
@@ -779,13 +801,10 @@ refresh_by_match_merge(Oid matviewOid, Oid tempOid, Oid relowner,
779801
"WHERE newdata.* IS NULL OR mv.* IS NULL "
780802
"ORDER BY tid");
781803

782-
/*Create the temporary "diff" table. */
783-
if (SPI_exec(querybuf.data,0)!=SPI_OK_UTILITY)
804+
/*Populate the temporary "diff" table. */
805+
if (SPI_exec(querybuf.data,0)!=SPI_OK_INSERT)
784806
elog(ERROR,"SPI_exec failed: %s",querybuf.data);
785807

786-
SetUserIdAndSecContext(relowner,
787-
save_sec_context |SECURITY_RESTRICTED_OPERATION);
788-
789808
/*
790809
* We have no further use for data from the "full-data" temp table, but we
791810
* must keep it around because its type is referenced from the diff table.

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp