Skip to content

Fix critical privilege escalation via function/operator overloading and search_path hijacking #29

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mdisec wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Fix critical privilege escalation via function/operator overloading and search_path hijacking #29

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
693eb96
Fully qualify remaining references in extension scripts
mdisec Aug 3, 2026
d28cd7d
Qualify oid-vs-reg* comparisons in extension scripts too
mdisec Aug 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 16 additions & 16 deletions scripts/ip4r--2.0--2.1.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,10 +7,10 @@

UPDATE pg_catalog.pg_cast SET castcontext = 'a'
WHERE (castsource,casttarget) IN (
('ipaddress'::regtype, 'ip4'::regtype),
('ipaddress'::regtype, 'ip6'::regtype),
('iprange'::regtype, 'ip4r'::regtype),
('iprange'::regtype, 'ip6r'::regtype));
('ipaddress'::regtype::oid, 'ip4'::regtype::oid),
('ipaddress'::regtype::oid, 'ip6'::regtype::oid),
('iprange'::regtype::oid, 'ip4r'::regtype::oid),
('iprange'::regtype::oid, 'ip6r'::regtype::oid));

-- double ugh, to finally fix long-standing issue with function signature
-- of gist consistent functions
Expand All @@ -21,12 +21,12 @@ WITH v(gname,gtype) AS (
('gipr_consistent'::name, 'iprange'::regtype))
UPDATE pg_catalog.pg_proc
SET pronargs = 5,
proargtypes = array_to_string(array['internal',
v.gtype,
'int2',
'oid',
'internal']::regtype[]::oid[],
' ')::pg_catalog.oidvector
proargtypes = pg_catalog.array_to_string(array['internal',
v.gtype,
'int2',
'oid',
'internal']::regtype[]::oid[],
' ')::pg_catalog.oidvector
FROM v
WHERE proname = v.gname
AND probin = 'MODULE_PATHNAME';
Expand All @@ -39,26 +39,26 @@ CREATE FUNCTION gipr_fetch(internal) RETURNS internal AS 'MODULE_PATHNAME' LANG

DO $s$
BEGIN
IF current_setting('server_version_num')::integer >= 90500 THEN
IF pg_catalog.current_setting('server_version_num')::integer >= 90500 THEN
ALTER OPERATOR FAMILY gist_ip4r_ops USING gist ADD
FUNCTION 9 (ip4r,ip4r) gip4r_fetch (internal);
ALTER OPERATOR FAMILY gist_ip6r_ops USING gist ADD
FUNCTION 9 (ip6r,ip6r) gip6r_fetch (internal);
ALTER OPERATOR FAMILY gist_iprange_ops USING gist ADD
FUNCTION 9 (iprange,iprange) gipr_fetch (internal);
END IF;
IF current_setting('server_version_num')::integer >= 90600 THEN
IF pg_catalog.current_setting('server_version_num')::integer >= 90600 THEN
DECLARE
r record;
BEGIN
FOR r IN SELECT oid::regprocedure as fsig
FROM pg_catalog.pg_proc
WHERE (probin = 'MODULE_PATHNAME'
AND prolang = (SELECT oid FROM pg_catalog.pg_language l WHERE l.lanname='c'))
OR (oid in ('family(ip4)'::regprocedure,
'family(ip6)'::regprocedure,
'family(ip4r)'::regprocedure,
'family(ip6r)'::regprocedure))
OR (oid in ('family(ip4)'::regprocedure::oid,
'family(ip6)'::regprocedure::oid,
'family(ip4r)'::regprocedure::oid,
'family(ip6r)'::regprocedure::oid))
LOOP
EXECUTE pg_catalog.format('ALTER FUNCTION %s PARALLEL SAFE', r.fsig);
END LOOP;
Expand Down
12 changes: 6 additions & 6 deletions scripts/ip4r--2.1--2.2.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,12 +12,12 @@ WITH v(gname,gtype) AS (
('gipr_consistent'::name, 'iprange'::regtype))
UPDATE pg_catalog.pg_proc
SET pronargs = 5,
proargtypes = array_to_string(array['internal',
v.gtype,
'int2',
'oid',
'internal']::regtype[]::oid[],
' ')::pg_catalog.oidvector
proargtypes = pg_catalog.array_to_string(array['internal',
v.gtype,
'int2',
'oid',
'internal']::regtype[]::oid[],
' ')::pg_catalog.oidvector
FROM v
WHERE proname = v.gname
AND probin = 'MODULE_PATHNAME';
Expand Down
68 changes: 34 additions & 34 deletions scripts/ip4r--2.2--2.4.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,25 +78,25 @@ DO $s$
cfgval text := NULL;
BEGIN
BEGIN
cfgval := current_setting('ip4r.update_indexes');
cfgval := pg_catalog.current_setting('ip4r.update_indexes');
EXCEPTION WHEN OTHERS THEN
cfgval := NULL;
END;
IF cfgval NOT IN ('drop','rebuild') THEN
cfgval := NULL;
END IF;
SELECT oid INTO opc_oid
FROM pg_opclass
FROM pg_catalog.pg_opclass
WHERE opcname='hash_iprange_ops'
AND pg_opclass_is_visible(oid);
AND pg_catalog.pg_opclass_is_visible(oid);
-- first check for unknown/unexpected dependencies
SELECT pg_catalog.format('%s object %s depends on hash_iprange_ops with type ''%s''',
classid::regclass, objid, deptype)
INTO str
FROM pg_depend
WHERE refclassid = 'pg_opclass'::regclass
FROM pg_catalog.pg_depend
WHERE refclassid OPERATOR(pg_catalog.=) 'pg_opclass'::regclass
AND refobjid = opc_oid
AND classid <> 'pg_class'::regclass
AND classid OPERATOR(pg_catalog.<>) 'pg_class'::regclass
AND deptype NOT IN ('a','i')
LIMIT 1;
IF FOUND THEN
Expand All @@ -105,16 +105,16 @@ DO $s$
DETAIL = str;
END IF;
-- find all dependent tables and indexes
deps := ARRAY(SELECT objid FROM pg_depend
WHERE refclassid = 'pg_opclass'::regclass
deps := ARRAY(SELECT objid FROM pg_catalog.pg_depend
WHERE refclassid OPERATOR(pg_catalog.=) 'pg_opclass'::regclass
AND refobjid = opc_oid
AND classid = 'pg_class'::regclass
AND classid OPERATOR(pg_catalog.=) 'pg_class'::regclass
AND deptype = 'n');
IF deps <> '{}' THEN
IF deps OPERATOR(pg_catalog.<>) '{}' THEN
-- we don't expect to find anything except indexes
SELECT pg_catalog.format('Table %s depends on hash_iprange_ops', oid::regclass)
INTO str
FROM pg_class
FROM pg_catalog.pg_class
WHERE oid = ANY (deps)
AND relkind <> 'i';
IF FOUND THEN
Expand All @@ -127,10 +127,10 @@ DO $s$
FOR r IN SELECT ci.relname as indexname,
n.nspname as schemaname,
ct.relname as tablename
FROM pg_index i
JOIN pg_class ci ON ci.oid=i.indexrelid
JOIN pg_class ct ON ct.oid=i.indrelid
JOIN pg_namespace n ON n.oid=ct.relnamespace
FROM pg_catalog.pg_index i
JOIN pg_catalog.pg_class ci ON ci.oid=i.indexrelid
JOIN pg_catalog.pg_class ct ON ct.oid=i.indrelid
JOIN pg_catalog.pg_namespace n ON n.oid=ct.relnamespace
WHERE i.indexrelid = ANY (deps)
LOOP
RAISE INFO USING
Expand All @@ -149,26 +149,26 @@ DO $s$
n.nspname as schemaname,
ct.relname as tablename,
ci.relname as indexname,
pg_get_indexdef(ci.oid) as command
FROM pg_index i
JOIN pg_class ci ON ci.oid=i.indexrelid
JOIN pg_class ct ON ct.oid=i.indrelid
JOIN pg_namespace n ON n.oid=ct.relnamespace
pg_catalog.pg_get_indexdef(ci.oid) as command
FROM pg_catalog.pg_index i
JOIN pg_catalog.pg_class ci ON ci.oid=i.indexrelid
JOIN pg_catalog.pg_class ct ON ct.oid=i.indrelid
JOIN pg_catalog.pg_namespace n ON n.oid=ct.relnamespace
WHERE i.indexrelid = ANY (deps);
ALTER EXTENSION ip4r DROP TABLE ip4r_update_to_2_4.update_indexes;
FOR r IN SELECT pg_catalog.format('DROP INDEX %s RESTRICT', o::regclass) as cmd
FROM UNNEST(deps) u(o) LOOP
FROM pg_catalog.unnest(deps) u(o) LOOP
RAISE INFO 'executing %', r.cmd;
EXECUTE r.cmd;
END LOOP;
ELSIF cfgval = 'rebuild' THEN
cmds := '{}';
FOR r IN SELECT pg_catalog.format('DROP INDEX %s RESTRICT', o::regclass) as dropcmd,
pg_get_indexdef(o) as createcmd
FROM UNNEST(deps) u(o) LOOP
pg_catalog.pg_get_indexdef(o) as createcmd
FROM pg_catalog.unnest(deps) u(o) LOOP
RAISE INFO 'executing %', r.dropcmd;
EXECUTE r.dropcmd;
cmds := cmds || r.createcmd;
cmds := pg_catalog.array_append(cmds, r.createcmd);
END LOOP;
END IF;
END IF;
Expand All @@ -181,14 +181,14 @@ DO $s$
OPERATOR 1 = ,
FUNCTION 1 iprange_hash(iprange);
IF cmds IS NOT NULL THEN
FOR r IN SELECT cmd FROM UNNEST(cmds) u(cmd) LOOP
FOR r IN SELECT cmd FROM pg_catalog.unnest(cmds) u(cmd) LOOP
-- we rely here on CREATE INDEX not recording a dependency on
-- the extension
RAISE INFO 'executing %', r.cmd;
EXECUTE r.cmd;
END LOOP;
RAISE INFO 'index rebuilds completed';
ELSIF cfgval = 'drop' AND deps <> '{}' THEN
ELSIF cfgval = 'drop' AND deps OPERATOR(pg_catalog.<>) '{}' THEN
RAISE LOG 'table ip4r_update_to_2_4.update_indexes was created';
RAISE INFO 'table ip4r_update_to_2_4.update_indexes was created';
END IF;
Expand All @@ -197,27 +197,27 @@ $s$;

DO $s$
DECLARE
pg_ver integer := current_setting('server_version_num')::integer;
pg_ver integer := pg_catalog.current_setting('server_version_num')::integer;
r record;
BEGIN
IF pg_ver >= 90600 THEN
FOR r IN SELECT oid::regprocedure as fsig
FROM pg_catalog.pg_proc
WHERE (probin = 'MODULE_PATHNAME'
AND prolang = (SELECT oid FROM pg_catalog.pg_language l WHERE l.lanname='c'))
OR (oid in ('family(ip4)'::regprocedure,
'family(ip6)'::regprocedure,
'family(ip4r)'::regprocedure,
'family(ip6r)'::regprocedure))
OR (oid in ('family(ip4)'::regprocedure::oid,
'family(ip6)'::regprocedure::oid,
'family(ip4r)'::regprocedure::oid,
'family(ip6r)'::regprocedure::oid))
LOOP
EXECUTE pg_catalog.format('ALTER FUNCTION %s PARALLEL SAFE', r.fsig);
END LOOP;
END IF;
IF pg_ver >= 110000 THEN
FOR r IN SELECT tname
FROM UNNEST(ARRAY['ip4','ip4r',
'ip6','ip6r',
'ipaddress','iprange']) u(tname)
FROM pg_catalog.unnest(ARRAY['ip4','ip4r',
'ip6','ip6r',
'ipaddress','iprange']) u(tname)
LOOP
EXECUTE pg_catalog.format('ALTER OPERATOR FAMILY %I USING hash'
' ADD FUNCTION 2 %I(%I,bigint)',
Expand Down
16 changes: 8 additions & 8 deletions scripts/ip4r--2.4.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -821,7 +821,7 @@ CREATE OPERATOR CLASS gist_iprange_ops DEFAULT FOR TYPE iprange USING gist AS

DO $s$
DECLARE
pg_ver integer := current_setting('server_version_num')::integer;
pg_ver integer := pg_catalog.current_setting('server_version_num')::integer;
r record;
BEGIN
IF pg_ver >= 90500 THEN
Expand All @@ -837,19 +837,19 @@ DO $s$
FROM pg_catalog.pg_proc
WHERE (probin = 'MODULE_PATHNAME'
AND prolang = (SELECT oid FROM pg_catalog.pg_language l WHERE l.lanname='c'))
OR (oid in ('family(ip4)'::regprocedure,
'family(ip6)'::regprocedure,
'family(ip4r)'::regprocedure,
'family(ip6r)'::regprocedure))
OR (oid in ('family(ip4)'::regprocedure::oid,
'family(ip6)'::regprocedure::oid,
'family(ip4r)'::regprocedure::oid,
'family(ip6r)'::regprocedure::oid))
LOOP
EXECUTE pg_catalog.format('ALTER FUNCTION %s PARALLEL SAFE', r.fsig);
END LOOP;
END IF;
IF pg_ver >= 110000 THEN
FOR r IN SELECT tname
FROM UNNEST(ARRAY['ip4','ip4r',
'ip6','ip6r',
'ipaddress','iprange']) u(tname)
FROM pg_catalog.unnest(ARRAY['ip4','ip4r',
'ip6','ip6r',
'ipaddress','iprange']) u(tname)
LOOP
EXECUTE pg_catalog.format('ALTER OPERATOR FAMILY %I USING hash'
' ADD FUNCTION 2 %I(%I,bigint)',
Expand Down