Heap Out-of-Bounds Read in Clickhouse's LZ4 Compression Codec

CVE-2021-42387

What is CVE-2021-42387?

This vulnerability allows an attacker to exploit a heap out-of-bounds read in Clickhouse's LZ4 compression codec. When parsing specially crafted queries, a 16-bit unsigned user-supplied value, referred to as 'offset', is read from the compressed data. Upon usage, this offset can lead to improper bounds checking, potentially enabling the attacker to extract sensitive information from memory or cause unexpected behavior in the application.

References