Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability arises from the postgres-protocol client's handling of hstore data types when receiving them from a PostgreSQL server. Specifically, the HstoreEntries::next method, which is part of the FallibleIterator implementation for HstoreEntries, is responsible for parsing the key-value pairs within an hstore binary representation. A malicious or compromised server could send an hstore value where the declared length of a key or value (read as key_len or value_len) is greater than the actual remaining bytes in the buffer. In the vulnerable version, the code used self.buf.split_at(length as usize). The split_at method in Rust panics if the provided index is out of bounds (i.e., greater than the slice's length). This unhandled panic would crash the client application, leading to a denial of service. The fix involves replacing split_at with split_at_checked, which returns an Option<(&[T], &[T])>. By checking the Option and returning an error (ok_or("invalid key length")?) if split_at_checked returns None, the client can gracefully handle malformed input without crashing. Thus, the HstoreEntries::next function is the precise location where the vulnerability manifests, as it directly processes the untrusted length fields and performs the unsafe slicing operation.
HstoreEntries::nextpostgres-protocol/src/types/mod.rs
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| postgres-protocol | rust | < 0.6.12 | 0.6.12 |