CVE-2023-5870: Postgresql: role pg_signal_backend can signal certain superuser processes.
A flaw was found in PostgreSQL involving the pgcancelbackend role that signals background workers, including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Successful exploitation requires a non-core extension with a less-resilient background worker and would affect that specific background worker only. This issue may allow a remote high privileged user to launch a denial of service (DoS) attack.
Other sources
PostgreSQL is vulnerable to a denial of service, caused by a flaw in the pgsignalbackend role. By sending a specially crafted request, a remote authenticated attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
The documentation says the pgsignalbackend role cannot signal "a backend owned by a superuser". On the contrary, it can signal background workers, including the logical replication launcher. It can signal autovacuum workers and the autovacuum launcher. Signaling autovacuum workers and those two launchers provides no meaningful exploit, so exploiting this vulnerability requires a non-core extension with a less-resilient background worker. For example, a non-core background worker that does not auto-restart would experience a denial of service with respect to that particular background worker.
The PostgreSQL project thanks Hemanth Sandrana and Mahendrakar Srinivasarao for reporting this problem.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-5870?
The severity of CVE-2023-5870 is low.
How do I update my PostgreSQL package to fix CVE-2023-5870?
You can update your PostgreSQL package to version 16.1 or apply the appropriate security updates for your specific version.
Where can I find more information about CVE-2023-5870?
You can find more information about CVE-2023-5870 at the following references: [link1], [link2], [link3].