CVE-2021-42388

Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user-supplied value ('offset') is read from the compressed data. The offset is later used in the length of a copy operation, without checking the lower bounds of the source of the copy operation.

CVSS v3.1

8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CVSS v2.0

5.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:P

EPSS

1.57% chance of exploitation in the next 30 days, 74th percentile

Published

2022-03-14

Updated

2024-08-04

Proof-of-concept exploits (1)

• https://jfrog.com/blog/7-rce-and-dos-vulnerabilities-found-in-clickhouse-dbms

References

• CVE Record
• NVD entry

Related

• CVE-2021-42387
• CVE-2021-42389
• CVE-2021-42374
• CVE-2021-42390
• CVE-2021-42372
• CVE-2021-42391