Heap Out-of-Bounds Read in Clickhouse's LZ4 Compression Codec

CVE-2021-42387

What is CVE-2021-42387?

This vulnerability allows an attacker to exploit a heap out-of-bounds read in Clickhouse's LZ4 compression codec. When parsing specially crafted queries, a 16-bit unsigned user-supplied value, referred to as 'offset', is read from the compressed data. Upon usage, this offset can lead to improper bounds checking, potentially enabling the attacker to extract sensitive information from memory or cause unexpected behavior in the application.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References