Miggo Logo

CVE-2024-7348:
Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object...

8.8

CVSS Score
3.1

Basic Information

EPSS Score
0.50492%
Published
8/8/2024
Updated
8/8/2024
KEV Status
No
Technology
-

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability is a TOCTOU race condition within the 'pg_dump' utility. It's not tied to a specific, named function that can be easily identified from the provided information without access to the source code changes (commit diffs). The fix involves a new server-side parameter ('restrict_nonsystem_relation_kind') and changes in 'pg_dump' to respect this parameter. The vulnerability lies in the operational sequence of 'pg_dump' (checking an object then later dumping it), allowing an attacker to change the object in between. Without specific patch details showing modified C functions within 'pg_dump', it's impossible to list precise function signatures. The primary runtime indicator is the 'pg_dump' process itself. The provided URLs and their content describe the vulnerability and the fix at a high level but do not point to specific C functions in 'pg_dump' that were modified.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

Tim*-o*-****k Tim*-o*-us* (TO*TOU) r*** *on*ition in p*_*ump in Post*r*SQL *llows *n o*j**t *r**tor to *x**ut* *r*itr*ry SQL *un*tions *s t** us*r runnin* p*_*ump, w*i** is o*t*n * sup*rus*r. T** *tt**k involv*s r*pl**in* *not**r r*l*tion typ* wit* *

Reasoning

T** vuln*r**ility is * TO*TOU r*** *on*ition wit*in t** 'p*_*ump' utility. It's not ti** to * sp**i*i*, n*m** *un*tion t**t **n ** **sily i**nti*i** *rom t** provi*** in*orm*tion wit*out ****ss to t** sour** *o** ***n**s (*ommit *i**s). T** *ix invol