Heap Out-of-Bounds Read Vulnerability in Clickhouse by Yandex

CVE-2021-42388

What is CVE-2021-42388?

A heap out-of-bounds read vulnerability exists in Clickhouse's LZ4 compression codec when processing poorly structured user queries. The flaw occurs during the LZ4::decompressImpl() function, where a 16-bit unsigned offset provided by the user is read from compressed data. This offset is subsequently used in operations without adequate validation, potentially leading to exploitation by malicious actors. Users of Clickhouse should be vigilant and apply the necessary security updates to mitigate this risk.

References