Divide-by-zero Vulnerability in ClickHouse's Delta Compression Codec

CVE-2021-42389

What is CVE-2021-42389?

This vulnerability involves a divide-by-zero scenario in ClickHouse's Delta compression codec, triggered when parsing a specially crafted malicious query. The issue arises because the first byte of the compressed buffer, which is processed in a modulo operation, is not validated for being zero before usage. This oversight could potentially lead to unexpected application behavior, impacting the stability and security of the database.

References