Heap Buffer Overflow in Clickhouse LZ4 Compression Codec

CVE-2021-43304

What is CVE-2021-43304?

A heap buffer overflow vulnerability exists in Clickhouse's LZ4 compression codec due to inadequate verification during the parsing of malicious queries. The flaw specifically resides in the arbitrary copy operation wildCopy<copy_amount>(op, ip, copy_end) within the LZ4::decompressImpl function, which does not adequately limit the destination buffer’s capacity. An attacker could exploit this vulnerability by crafting specific input queries, potentially leading to unauthorized actions and compromising the system's integrity.

References