From cc3992a9262b126bc16a2e9f620c41aedcf99cba Mon Sep 17 00:00:00 2001 From: Alexander Korotkov Date: Sat, 10 Aug 2024 16:19:28 +0300 Subject: [PATCH v4] Avoid repeated table name lookups in createPartitionTable() Currently, createPartitionTable() opens newly created table using its name. This approach is prone to privilege escalation attack, because we might end up opening another table than we just created. This commit address the issue above by opening newly created table by its oid. It appears to be tricky to get a relation oid out of ProcessUtility(). We have to extend TableLikeClause with new newRelationOid field, which is filled within ProcessUtility() to be further accessed by caller. Security: CVE-2014-0062 Reported-by: Noah Misch Discussion: https://postgr.es/m/20240808171351.a9.nmisch%40google.com Reviewed-by: Dmitry Koval --- src/backend/commands/tablecmds.c | 3 ++- src/backend/parser/gram.y | 1 + src/backend/tcop/utility.c | 6 ++++++ src/include/nodes/parsenodes.h | 1 + 4 files changed, 10 insertions(+), 1 deletion(-) diff --git a/src/backend/commands/tablecmds.c b/src/backend/commands/tablecmds.c index dfba5f357b8..bcc2d9ae0b3 100644 --- a/src/backend/commands/tablecmds.c +++ b/src/backend/commands/tablecmds.c @@ -20381,6 +20381,7 @@ createPartitionTable(RangeVar *newPartName, Relation modelRel, tlc->options = CREATE_TABLE_LIKE_ALL & ~(CREATE_TABLE_LIKE_INDEXES | CREATE_TABLE_LIKE_IDENTITY | CREATE_TABLE_LIKE_STATISTICS); tlc->relationOid = InvalidOid; + tlc->newRelationOid = InvalidOid; createStmt->tableElts = lappend(createStmt->tableElts, tlc); /* Need to make a wrapper PlannedStmt. */ @@ -20404,7 +20405,7 @@ createPartitionTable(RangeVar *newPartName, Relation modelRel, * Open the new partition with no lock, because we already have * AccessExclusiveLock placed there after creation. */ - newRel = table_openrv(newPartName, NoLock); + newRel = table_open(tlc->newRelationOid, NoLock); /* * We intended to create the partition with the same persistence as the diff --git a/src/backend/parser/gram.y b/src/backend/parser/gram.y index c3f25582c38..b7d98eb9f02 100644 --- a/src/backend/parser/gram.y +++ b/src/backend/parser/gram.y @@ -4138,6 +4138,7 @@ TableLikeClause: n->relation = $2; n->options = $3; n->relationOid = InvalidOid; + n->newRelationOid = InvalidOid; $$ = (Node *) n; } ; diff --git a/src/backend/tcop/utility.c b/src/backend/tcop/utility.c index b2ea8125c92..b385175e7a2 100644 --- a/src/backend/tcop/utility.c +++ b/src/backend/tcop/utility.c @@ -1225,6 +1225,12 @@ ProcessUtilitySlow(ParseState *pstate, morestmts = expandTableLikeClause(table_rv, like); stmts = list_concat(morestmts, stmts); + + /* + * Store the OID of newly created relation to the + * TableLikeClause for the caller to use it. + */ + like->newRelationOid = address.objectId; } else { diff --git a/src/include/nodes/parsenodes.h b/src/include/nodes/parsenodes.h index 85a62b538e5..577c4bfef76 100644 --- a/src/include/nodes/parsenodes.h +++ b/src/include/nodes/parsenodes.h @@ -754,6 +754,7 @@ typedef struct TableLikeClause RangeVar *relation; bits32 options; /* OR of TableLikeOption flags */ Oid relationOid; /* If table has been looked up, its OID */ + Oid newRelationOid; /* OID of newly created table */ } TableLikeClause; typedef enum TableLikeOption -- 2.39.3 (Apple Git-146)