Heap Out-of-Bounds Read Vulnerability in Clickhouse by Yandex

CVE-2021-42388

What is CVE-2021-42388?

A heap out-of-bounds read vulnerability exists in Clickhouse's LZ4 compression codec when processing poorly structured user queries. The flaw occurs during the LZ4::decompressImpl() function, where a 16-bit unsigned offset provided by the user is read from compressed data. This offset is subsequently used in operations without adequate validation, potentially leading to exploitation by malicious actors. Users of Clickhouse should be vigilant and apply the necessary security updates to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References