Cloudanix VulnDB

CVE-2023-48298

High · 7.5

CVSS

7.5

EPSS

0.6%

Published

Dec 21, 2023

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in the database software can let anyone on the network send bad data that makes the service crash and stop working until it is restarted.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Application
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Integer underflow in FPC codec decompression triggers stack buffer overflow, causing process crash and denial of service.

Why it matters to the business

Analytical database services become unavailable, interrupting real-time reporting and data queries until the affected instance is restarted or patched.

How an attack unfolds

An unauthenticated remote attacker crafts a malicious FPC-compressed payload and sends it to a ClickHouse instance; the server attempts decompression, hits the integer underflow, overflows the stack buffer, and crashes, similar to the exploitation path seen in CVE-2023-47118.

How to fix it

Upgrade ClickHouse to a version containing the fix for this integer underflow once released by the project maintainers; in the interim restrict network access to database ports and disable unauthenticated access where possible.

How to confirm the fix worked

Confirm the presence of the vulnerable FPC decompression code path by reviewing source or binary for the affected codec function, then test with a non-malicious FPC payload to ensure the server remains stable after upgrade.

Typical attack path

  1. Identify exposed ClickHouse HTTP or native protocol endpoints
  2. Craft and transmit a specially formed FPC-compressed data block
  3. Trigger decompression path in the server process
  4. Cause integer underflow leading to stack buffer overflow and crash

How to detect it

Review ClickHouse server logs for repeated crashes or stack traces mentioning FPC codec decompression failures; correlate with incoming connections from untrusted sources around the time of the crash.

  • FPC codec stack buffer overflow
  • clickhouse-server.*FPC.*underflow
  • signal 11.*decompress

What your security team should do

  • Prioritize patching ClickHouse instances as soon as fixed releases become available
  • Restrict inbound access to ClickHouse ports from untrusted networks
  • Monitor vendor advisories for the exact fixed version numbers
  • Enable process crash logging and alerting for rapid detection of exploitation attempts

The record

ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time. This vulnerability is an integer underflow resulting in crash due to stack buffer overflow in decompression of FPC codec. It can be triggered and exploited by an unauthenticated attacker. The vulnerability is very similar to CVE-2023-47118 with how the vulnerable function can be exploited.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 clickhouse 0 No fix
Debian:12 clickhouse 0 No fix
Ubuntu:20.04:LTS clickhouse 0 No fix
Ubuntu:24.04:LTS clickhouse 0 No fix
Ubuntu:Pro:20.04:LTS clickhouse 0 No fix

Related vulnerabilities