CVE-2022-44011

What it actually does

An authenticated user with data loading privileges can trigger a heap buffer overflow by inserting a malformed CapnProto object, causing the server process to crash.

Why it matters to the business

Unexpected database server crashes lead to loss of availability, potential data processing interruptions, and operational downtime for dependent applications.

How an attack unfolds

An attacker authenticates with data insertion rights, crafts a specially malformed CapnProto payload, and submits it via an INSERT operation, exploiting insufficient bounds checking in the deserialization path to overflow a heap buffer and crash the server.

How to fix it

Upgrade ClickHouse to one of the fixed versions: 22.9.1.2603, 22.8.2.11, 22.7.4.16, 22.6.6.16, or 22.3.12.19, or apply the patch from commit 0b9272f8fdc8052d86f445be302b137b7d30e842.

How to confirm the fix worked

Confirm the running version matches or exceeds a fixed release, then attempt insertion of known-malformed CapnProto objects in a test environment to verify the server no longer crashes.

Typical attack path

1. Obtain credentials with data loading privileges
2. Craft a malformed CapnProto object designed to trigger overflow
3. Issue an INSERT statement containing the malformed object
4. Observe server crash due to heap buffer overflow

How to detect it

Inspect ClickHouse server logs for abrupt crashes or segmentation faults immediately following INSERT operations involving CapnProto-formatted data; correlate with authentication and query logs for unusual load activity.

What your security team should do

• Upgrade to a fixed ClickHouse version as soon as possible
• Limit data loading privileges to the minimum necessary users
• Review and harden input validation for external data ingestion pipelines