CVE-2024-7348:
Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object...
8.8
Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability is a TOCTOU race condition within the 'pg_dump' utility. It's not tied to a specific, named function that can be easily identified from the provided information without access to the source code changes (commit diffs). The fix involves a new server-side parameter ('restrict_nonsystem_relation_kind') and changes in 'pg_dump' to respect this parameter. The vulnerability lies in the operational sequence of 'pg_dump' (checking an object then later dumping it), allowing an attacker to change the object in between. Without specific patch details showing modified C functions within 'pg_dump', it's impossible to list precise function signatures. The primary runtime indicator is the 'pg_dump' process itself. The provided URLs and their content describe the vulnerability and the fix at a high level but do not point to specific C functions in 'pg_dump' that were modified.