CVE-2015-3165

What it actually does

Double-free condition in PostgreSQL SSL session shutdown logic when an authentication timeout expires during connection closure, resulting in memory corruption that crashes the server process.

Why it matters to the business

Remote attackers can cause PostgreSQL database instances to crash, leading to unplanned downtime, loss of availability for applications relying on the database, and potential data inconsistency during recovery.

How an attack unfolds

An unauthenticated remote attacker initiates an SSL connection to a PostgreSQL server, allows the authentication timeout to near expiration, then abruptly closes the SSL session in a manner that triggers the double-free during shutdown sequence, crashing the backend.

How to fix it

Upgrade PostgreSQL to 9.0.20 or later, 9.1.16 or later, 9.2.11 or later, 9.3.7 or later, or 9.4.2 or later depending on the installed branch; apply vendor-supplied patches for affected operating system packages; disable SSL if not required and restart services.

How to confirm the fix worked

Verify PostgreSQL version is at or above the fixed releases listed in the advisory; review server logs for absence of crash signatures related to SSL shutdown; test connectivity with SSL sessions under simulated authentication timeout conditions.

Typical attack path

1. Establish SSL connection to PostgreSQL listener
2. Delay or manipulate authentication phase to approach timeout window
3. Close SSL session during the critical shutdown sequence
4. Trigger double-free and resulting crash

How to detect it

Review PostgreSQL server logs for repeated backend crashes during SSL connection shutdowns or authentication timeout events; correlate with network logs showing short-lived SSL handshakes; examine core dumps or memory error logs for double-free indicators if available.

What your security team should do

• Immediately inventory all PostgreSQL deployments and prioritize upgrades for internet-facing or high-value instances
• Apply the minimum required patched versions for each branch
• Monitor for new EPSS increases or exploit code publication given the 11-year disclosure window
• Implement network segmentation and authentication hardening to reduce exposure window