PostGIS address_standardizer Out-of-Bounds Read in Weight Parameter

Executive Summary

PostGIS address_standardizer through 3.7.0 fails to validate the Weight parameter from caller-supplied rules tables before using it as an array index. Attackers can craft malicious rule rows with out-of-range Weight values to trigger out-of-bounds reads in the load_value array, causing the PostgreSQL backend process to crash and terminate all cluster sessions.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect PostGIS address_standardizer rules tables for out-of-range Weight values. Check PostgreSQL logs for crashes in backend processes. Use SQL queries to examine rule weights in the rules table. Example: SELECT * FROM rules WHERE weight < 0 OR weight >= NUMBER_OF_WEIGHTS;

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause PostgreSQL backend processes to crash, leading to denial of service for all cluster sessions. Attackers could exploit it to terminate database operations by providing maliciously crafted address rules with invalid Weight values.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes PostgreSQL backend crashes due to out-of-bounds reads, leading to denial of service and session termination. It does not directly impact data confidentiality or integrity but may disrupt systems handling sensitive data, potentially affecting compliance with GDPR or HIPAA by causing service unavailability or data processing delays.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade PostGIS address_standardizer to version 3.7.1dev or later. Apply the patch from commit a5cb4b1 or PR #6 which adds validation for rule weights. Remove or correct any existing rules with invalid Weight values in your rules tables.

Useful 0 Not Useful 0