Heap Buffer Overflow in Clickhouse LZ4 Compression Codec

CVE-2021-43304

What is CVE-2021-43304?

A heap buffer overflow vulnerability exists in Clickhouse's LZ4 compression codec due to inadequate verification during the parsing of malicious queries. The flaw specifically resides in the arbitrary copy operation wildCopy<copy_amount>(op, ip, copy_end) within the LZ4::decompressImpl function, which does not adequately limit the destination buffer’s capacity. An attacker could exploit this vulnerability by crafting specific input queries, potentially leading to unauthorized actions and compromising the system's integrity.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References