Cloudanix VulnDB

CVE-2024-10978

None

CVSS

—

EPSS

0.7%

Published

Nov 14, 2024

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A database identity-switch bug can let a lower-privilege user see or change the wrong people's records when an application changes roles inside the database.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Data Exposure
Component
Network Service
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

PostgreSQL incorrectly reports session identity after SET ROLE, SET SESSION AUTHORIZATION, or an equivalent switch. Queries, views, functions, triggers, or row-level security policies that consult current_setting('role') or the current user ID can therefore read or write a different set of rows than the switched role was supposed to allow. The mistaken identity is not attacker-chosen. Untrusted SQL text is out of scope; the defect is limited to application queries that take attacker-influenced parameters or return results to the attacker and that key authorization on those identity functions.

Why it matters to the business

Applications that use database role switching for multi-tenant isolation, impersonation, or least privilege can leak or alter another party's records, with confidentiality, integrity, and compliance consequences. Active exploitation risk is low: EPSS is about 0.69% and flat over 30 days, the CVE is not in CISA KEV, it is not associated with ransomware, and exploit maturity is none. Residual risk is still material wherever SET ROLE is a security boundary, especially given that the issue has been public since November 2024 and unpatched 12.x–17.x servers remain exposed.

How an attack unfolds

A caller who already has a less-privileged application identity uses a feature that makes the application issue SET ROLE or SET SESSION AUTHORIZATION, then drives a query that accepts their parameters or returns rows to them. If that query (or an RLS policy, view, or trigger it invokes) branches on current_setting('role') or the current user ID, PostgreSQL may evaluate the query as if the role switch never happened, so unintended rows are returned or modified. The attacker cannot select which wrong identity applies, so the effect is opportunistic data exposure or tampering rather than fully targeted takeover. No named threat actors or in-the-wild campaigns are associated with this CVE.

How to fix it

Upgrade PostgreSQL to a fixed minor release on the same major branch: 17.1, 16.5, 15.9, 14.14, 13.17, or 12.21 or later. Source builds should include upstream commit 20a82026828536331ebe912b86f060078a173633. Until patched, do not treat SET ROLE or SET SESSION AUTHORIZATION as an isolation boundary for queries that depend on current_setting('role') or current user ID; pass an explicit application-controlled tenant or actor key instead, and keep unvetted SQL out of those sessions. Packaging entries that map this CVE to unrelated products should not delay PostgreSQL upgrades.

How to confirm the fix worked

Run SELECT version() and confirm the server is at least 17.1, 16.5, 15.9, 14.14, 13.17, or 12.21 as applicable. Inventory SET ROLE / SET SESSION AUTHORIZATION usage and any RLS policies, views, functions, or triggers that reference current_setting('role'), current_user, or session_user. After upgrade, regression-test impersonation and tenant-switch flows: switch role, then confirm identity functions and subsequent reads/writes match the intended role and cannot return or modify another identity's rows.

Typical attack path

  1. Authenticate or register as a legitimate less-privileged application user
  2. Invoke an application flow that causes the backend to run SET ROLE, SET SESSION AUTHORIZATION, or equivalent
  3. Drive a parameterized read or write whose SQL, RLS policy, view, or trigger consults current_setting('role') or the current user ID
  4. Receive or change rows belonging to an unintended identity
  5. Repeat across sessions or tenants to increase the chance of hitting sensitive records

How to detect it

There is no public exploit, named actor, or distinctive payload, so prior abuse is inferred from data-access anomalies rather than malware artifacts. Review PostgreSQL logs (log_statement / log_min_duration_statement, pgaudit, pg_stat_statements) for sessions that issued SET ROLE or SET SESSION AUTHORIZATION and then executed statements referencing current_setting('role'), current_user, or session_user, especially when followed by unexpected row counts or cross-account reads and writes. Correlate application audit trails of impersonation or tenant-switch features with customer reports of seeing another party's data, focusing on activity since 2024-11-14. Investigate anomalous SELECT/UPDATE/DELETE volume immediately after role-switch statements; lack of file, process, or network IOCs means empty-handed malware hunts are expected.

What your security team should do

  • Inventory PostgreSQL 12–17 instances and patch first those applications that use SET ROLE or SET SESSION AUTHORIZATION for isolation
  • Map RLS policies, views, functions, and triggers that depend on current_setting('role') or current user ID and treat them as high-impact until patched
  • Do not wait for KEV or EPSS movement; isolation-boundary failures in multi-tenant apps warrant scheduled upgrades now
  • After patching, re-test tenant and impersonation isolation and retain evidence of version and test results
  • Temporarily increase statement or pgaudit logging on role-switch paths to support hunting and validation
  • Ignore unrelated chromium-browser CPE mappings when prioritizing this CVE

The record

Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended. An attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or an equivalent feature. The problem arises when an application query uses parameters from the attacker or conveys query results to the attacker. If that query reacts to current_setting('role') or the current user ID, it may modify or return data as though the session had not used SET ROLE or SET SESSION AUTHORIZATION. The attacker does not control which incorrect user ID applies. Query text from less-privileged sources is not a concern here, because SET ROLE and SET SESSION AUTHORIZATION are not sandboxes for unvetted queries. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.

Affected packages

Ecosystem Package Introduced Fixed
AlmaLinux:8 pg_repack 0 1.4.6-3.module_el8.6.0+2760+1746ec94
AlmaLinux:8 pg_repack 0 1.4.6-3.module_el8.9.0+3704+f1f917ce
AlmaLinux:8 pg_repack 0 1.4.8-1.module_el8.10.0+3798+606ebb9f
AlmaLinux:8 pg_repack 0 1.4.8-1.module_el8.9.0+3706+885c732e
AlmaLinux:8 pg_repack 0 1.5.1-1.module_el8.10.0+3930+ecf33554
AlmaLinux:8 pgaudit 0 1.4.0-7.module_el8.10.0+3889+48cb11fb.alma.1
AlmaLinux:8 pgaudit 0 1.4.0-7.module_el8.9.0+3740+0e74851f.alma.1
AlmaLinux:8 pgaudit 0 1.7.0-1.module_el8.9.0+3706+885c732e
AlmaLinux:8 pgaudit 0 16.0-1.module_el8.10.0+3798+606ebb9f
AlmaLinux:8 pgaudit 0 1.5.0-1.module_el8.6.0+2760+1746ec94
AlmaLinux:8 pgaudit 0 1.5.0-1.module_el8.6.0+3095+ee60d910
AlmaLinux:8 postgres-decoderbufs 0 0.10.0-2.module_el8.6.0+2760+1746ec94
AlmaLinux:8 postgres-decoderbufs 0 0.10.0-2.module_el8.6.0+3095+ee60d910
AlmaLinux:8 postgres-decoderbufs 0 0.10.0-2.module_el8.9.0+3704+f1f917ce
AlmaLinux:8 postgres-decoderbufs 0 1.9.7-1.Final.module_el8.9.0+3706+885c732e
AlmaLinux:8 postgres-decoderbufs 0 2.4.0-1.Final.module_el8.10.0+3798+606ebb9f
AlmaLinux:8 postgresql 0 12.22-1.module_el8.10.0+3927+7f0fab70
AlmaLinux:8 postgresql 0 15.10-1.module_el8.10.0+3929+38258aa5
AlmaLinux:8 postgresql 0 16.6-1.module_el8.10.0+3930+ecf33554
AlmaLinux:8 postgresql 0 13.18-1.module_el8.10.0+3928+8233d274
AlmaLinux:8 postgresql-contrib 0 12.22-1.module_el8.10.0+3927+7f0fab70
AlmaLinux:8 postgresql-contrib 0 15.10-1.module_el8.10.0+3929+38258aa5
AlmaLinux:8 postgresql-contrib 0 16.6-1.module_el8.10.0+3930+ecf33554
AlmaLinux:8 postgresql-contrib 0 13.18-1.module_el8.10.0+3928+8233d274
AlmaLinux:8 postgresql-docs 0 12.22-1.module_el8.10.0+3927+7f0fab70
AlmaLinux:8 postgresql-docs 0 15.10-1.module_el8.10.0+3929+38258aa5
AlmaLinux:8 postgresql-docs 0 16.6-1.module_el8.10.0+3930+ecf33554
AlmaLinux:8 postgresql-docs 0 13.18-1.module_el8.10.0+3928+8233d274
AlmaLinux:8 postgresql-plperl 0 12.22-1.module_el8.10.0+3927+7f0fab70
AlmaLinux:8 postgresql-plperl 0 15.10-1.module_el8.10.0+3929+38258aa5
AlmaLinux:8 postgresql-plperl 0 16.6-1.module_el8.10.0+3930+ecf33554
AlmaLinux:8 postgresql-plperl 0 13.18-1.module_el8.10.0+3928+8233d274
AlmaLinux:8 postgresql-plpython3 0 12.22-1.module_el8.10.0+3927+7f0fab70
AlmaLinux:8 postgresql-plpython3 0 15.10-1.module_el8.10.0+3929+38258aa5
AlmaLinux:8 postgresql-plpython3 0 16.6-1.module_el8.10.0+3930+ecf33554
AlmaLinux:8 postgresql-plpython3 0 13.18-1.module_el8.10.0+3928+8233d274
AlmaLinux:8 postgresql-pltcl 0 12.22-1.module_el8.10.0+3927+7f0fab70
AlmaLinux:8 postgresql-pltcl 0 15.10-1.module_el8.10.0+3929+38258aa5
AlmaLinux:8 postgresql-pltcl 0 16.6-1.module_el8.10.0+3930+ecf33554
AlmaLinux:8 postgresql-pltcl 0 13.18-1.module_el8.10.0+3928+8233d274
AlmaLinux:8 postgresql-private-devel 0 15.10-1.module_el8.10.0+3929+38258aa5
AlmaLinux:8 postgresql-private-devel 0 16.6-1.module_el8.10.0+3930+ecf33554
AlmaLinux:8 postgresql-private-libs 0 15.10-1.module_el8.10.0+3929+38258aa5
AlmaLinux:8 postgresql-private-libs 0 16.6-1.module_el8.10.0+3930+ecf33554
AlmaLinux:8 postgresql-server 0 12.22-1.module_el8.10.0+3927+7f0fab70
AlmaLinux:8 postgresql-server 0 15.10-1.module_el8.10.0+3929+38258aa5
AlmaLinux:8 postgresql-server 0 16.6-1.module_el8.10.0+3930+ecf33554
AlmaLinux:8 postgresql-server 0 13.18-1.module_el8.10.0+3928+8233d274
AlmaLinux:8 postgresql-server-devel 0 12.22-1.module_el8.10.0+3927+7f0fab70
AlmaLinux:8 postgresql-server-devel 0 15.10-1.module_el8.10.0+3929+38258aa5
AlmaLinux:8 postgresql-server-devel 0 16.6-1.module_el8.10.0+3930+ecf33554
AlmaLinux:8 postgresql-server-devel 0 13.18-1.module_el8.10.0+3928+8233d274
AlmaLinux:8 postgresql-static 0 12.22-1.module_el8.10.0+3927+7f0fab70
AlmaLinux:8 postgresql-static 0 15.10-1.module_el8.10.0+3929+38258aa5
AlmaLinux:8 postgresql-static 0 16.6-1.module_el8.10.0+3930+ecf33554
AlmaLinux:8 postgresql-static 0 13.18-1.module_el8.10.0+3928+8233d274
AlmaLinux:8 postgresql-test 0 12.22-1.module_el8.10.0+3927+7f0fab70
AlmaLinux:8 postgresql-test 0 15.10-1.module_el8.10.0+3929+38258aa5
AlmaLinux:8 postgresql-test 0 16.6-1.module_el8.10.0+3930+ecf33554
AlmaLinux:8 postgresql-test 0 13.18-1.module_el8.10.0+3928+8233d274
AlmaLinux:8 postgresql-test-rpm-macros 0 12.22-1.module_el8.10.0+3927+7f0fab70
AlmaLinux:8 postgresql-test-rpm-macros 0 15.10-1.module_el8.10.0+3929+38258aa5
AlmaLinux:8 postgresql-test-rpm-macros 0 16.6-1.module_el8.10.0+3930+ecf33554
AlmaLinux:8 postgresql-test-rpm-macros 0 13.18-1.module_el8.10.0+3928+8233d274
AlmaLinux:8 postgresql-upgrade 0 12.22-1.module_el8.10.0+3927+7f0fab70
AlmaLinux:8 postgresql-upgrade 0 15.10-1.module_el8.10.0+3929+38258aa5
AlmaLinux:8 postgresql-upgrade 0 16.6-1.module_el8.10.0+3930+ecf33554
AlmaLinux:8 postgresql-upgrade 0 13.18-1.module_el8.10.0+3928+8233d274
AlmaLinux:8 postgresql-upgrade-devel 0 12.22-1.module_el8.10.0+3927+7f0fab70
AlmaLinux:8 postgresql-upgrade-devel 0 15.10-1.module_el8.10.0+3929+38258aa5
AlmaLinux:8 postgresql-upgrade-devel 0 16.6-1.module_el8.10.0+3930+ecf33554
AlmaLinux:8 postgresql-upgrade-devel 0 13.18-1.module_el8.10.0+3928+8233d274
AlmaLinux:9 pg_repack 0 1.4.8-2.module_el9.5.0+120+4533eb20
AlmaLinux:9 pg_repack 0 1.5.1-1.module_el9.5.0+127+50ff03a9
AlmaLinux:9 pg_repack 0 1.5.1-1.module_el9.5.0+128+1095dce2
AlmaLinux:9 pgaudit 0 1.7.0-1.module_el9.3.0+52+21733919
AlmaLinux:9 pgaudit 0 16.0-1.module_el9.4.0+66+eb9878bc
AlmaLinux:9 pgvector 0 0.6.2-1.module_el9.5.0+120+4533eb20
AlmaLinux:9 postgres-decoderbufs 0 1.9.7-1.Final.module_el9.3.0+52+21733919
AlmaLinux:9 postgres-decoderbufs 0 2.4.0-1.Final.module_el9.4.0+66+eb9878bc
AlmaLinux:9 postgresql 0 15.10-1.module_el9.5.0+126+03d48c9f
AlmaLinux:9 postgresql 0 16.6-1.module_el9.5.0+127+50ff03a9
AlmaLinux:9 postgresql 0 16.6-1.module_el9.5.0+128+1095dce2
AlmaLinux:9 postgresql 0 13.18-1.el9_5
AlmaLinux:9 postgresql-contrib 0 15.10-1.module_el9.5.0+126+03d48c9f
AlmaLinux:9 postgresql-contrib 0 16.6-1.module_el9.5.0+127+50ff03a9
AlmaLinux:9 postgresql-contrib 0 16.6-1.module_el9.5.0+128+1095dce2
AlmaLinux:9 postgresql-contrib 0 13.18-1.el9_5
AlmaLinux:9 postgresql-docs 0 15.10-1.module_el9.5.0+126+03d48c9f
AlmaLinux:9 postgresql-docs 0 16.6-1.module_el9.5.0+127+50ff03a9
AlmaLinux:9 postgresql-docs 0 16.6-1.module_el9.5.0+128+1095dce2
AlmaLinux:9 postgresql-docs 0 13.18-1.el9_5
AlmaLinux:9 postgresql-plperl 0 15.10-1.module_el9.5.0+126+03d48c9f
AlmaLinux:9 postgresql-plperl 0 16.6-1.module_el9.5.0+127+50ff03a9
AlmaLinux:9 postgresql-plperl 0 13.18-1.el9_5
AlmaLinux:9 postgresql-plpython3 0 15.10-1.module_el9.5.0+126+03d48c9f
AlmaLinux:9 postgresql-plpython3 0 16.6-1.module_el9.5.0+127+50ff03a9
AlmaLinux:9 postgresql-plpython3 0 16.6-1.module_el9.5.0+128+1095dce2
AlmaLinux:9 postgresql-plpython3 0 13.18-1.el9_5
AlmaLinux:9 postgresql-pltcl 0 15.10-1.module_el9.5.0+126+03d48c9f
AlmaLinux:9 postgresql-pltcl 0 16.6-1.module_el9.5.0+128+1095dce2
AlmaLinux:9 postgresql-pltcl 0 13.18-1.el9_5
AlmaLinux:9 postgresql-private-devel 0 15.10-1.module_el9.5.0+126+03d48c9f
AlmaLinux:9 postgresql-private-devel 0 16.6-1.module_el9.5.0+127+50ff03a9
AlmaLinux:9 postgresql-private-devel 0 16.6-1.module_el9.5.0+128+1095dce2
AlmaLinux:9 postgresql-private-devel 0 13.18-1.el9_5
AlmaLinux:9 postgresql-private-libs 0 15.10-1.module_el9.5.0+126+03d48c9f
AlmaLinux:9 postgresql-private-libs 0 16.6-1.module_el9.5.0+127+50ff03a9
AlmaLinux:9 postgresql-private-libs 0 16.6-1.module_el9.5.0+128+1095dce2
AlmaLinux:9 postgresql-private-libs 0 13.18-1.el9_5
AlmaLinux:9 postgresql-server 0 15.10-1.module_el9.5.0+126+03d48c9f
AlmaLinux:9 postgresql-server 0 16.6-1.module_el9.5.0+127+50ff03a9
AlmaLinux:9 postgresql-server 0 16.6-1.module_el9.5.0+128+1095dce2
AlmaLinux:9 postgresql-server 0 13.18-1.el9_5
AlmaLinux:9 postgresql-server-devel 0 15.10-1.module_el9.5.0+126+03d48c9f
AlmaLinux:9 postgresql-server-devel 0 16.6-1.module_el9.5.0+127+50ff03a9
AlmaLinux:9 postgresql-server-devel 0 16.6-1.module_el9.5.0+128+1095dce2
AlmaLinux:9 postgresql-server-devel 0 13.18-1.el9_5
AlmaLinux:9 postgresql-static 0 15.10-1.module_el9.5.0+126+03d48c9f
AlmaLinux:9 postgresql-static 0 16.6-1.module_el9.5.0+127+50ff03a9
AlmaLinux:9 postgresql-static 0 16.6-1.module_el9.5.0+128+1095dce2
AlmaLinux:9 postgresql-static 0 13.18-1.el9_5
AlmaLinux:9 postgresql-test 0 15.10-1.module_el9.5.0+126+03d48c9f
AlmaLinux:9 postgresql-test 0 16.6-1.module_el9.5.0+127+50ff03a9
AlmaLinux:9 postgresql-test 0 16.6-1.module_el9.5.0+128+1095dce2
AlmaLinux:9 postgresql-test 0 13.18-1.el9_5
AlmaLinux:9 postgresql-test-rpm-macros 0 15.10-1.module_el9.5.0+126+03d48c9f
AlmaLinux:9 postgresql-test-rpm-macros 0 16.6-1.module_el9.5.0+127+50ff03a9
AlmaLinux:9 postgresql-test-rpm-macros 0 13.18-1.el9_5
AlmaLinux:9 postgresql-upgrade 0 15.10-1.module_el9.5.0+126+03d48c9f
AlmaLinux:9 postgresql-upgrade 0 16.6-1.module_el9.5.0+127+50ff03a9
AlmaLinux:9 postgresql-upgrade 0 16.6-1.module_el9.5.0+128+1095dce2
AlmaLinux:9 postgresql-upgrade 0 13.18-1.el9_5
AlmaLinux:9 postgresql-upgrade-devel 0 15.10-1.module_el9.5.0+126+03d48c9f
AlmaLinux:9 postgresql-upgrade-devel 0 16.6-1.module_el9.5.0+127+50ff03a9
AlmaLinux:9 postgresql-upgrade-devel 0 16.6-1.module_el9.5.0+128+1095dce2
AlmaLinux:9 postgresql-upgrade-devel 0 13.18-1.el9_5
Alpine:v3.17 postgresql14 0 14.14-r0
Alpine:v3.17 postgresql15 0 15.9-r0
Alpine:v3.18 postgresql14 0 14.14-r0
Alpine:v3.18 postgresql15 0 15.9-r0
Alpine:v3.19 postgresql15 0 15.9-r0
Alpine:v3.19 postgresql16 0 16.5-r0
Alpine:v3.20 postgresql15 0 15.9-r0
Alpine:v3.20 postgresql16 0 16.5-r0
Alpine:v3.21 postgresql16 0 16.5-r0
Alpine:v3.21 postgresql17 0 17.1-r0
Alpine:v3.22 postgresql16 0 16.5-r0
Alpine:v3.22 postgresql17 0 17.1-r0
Bitnami postgresql 0 12.21.0
Bitnami postgresql 0 13.17.0
Bitnami postgresql 17.0.0 17.1.0
Chainguard ecpg-13 0 13.17-r0
Chainguard ecpg-14 0 14.14-r0
Chainguard ecpg-15 0 15.9-r0
Chainguard ecpg-16 0 16.5-r0
Chainguard ecpg-17 0 17.1-r0
Chainguard libecpg-12 0 12.21-r0
Chainguard libecpg-13 0 13.17-r0
Chainguard libecpg-13-dev 0 13.17-r0
Chainguard libecpg-14 0 14.14-r0
Chainguard libecpg-14-dev 0 14.14-r0
Chainguard libecpg-15 0 15.9-r0
Chainguard libecpg-15-dev 0 15.9-r0
Chainguard libecpg-16 0 16.5-r0
Chainguard libecpg-16-dev 0 16.5-r0
Chainguard libecpg-17 0 17.1-r0
Chainguard libecpg-17-dev 0 17.1-r0
Chainguard libpq-12 0 12.21-r0
Chainguard libpq-13 0 13.17-r0
Chainguard libpq-14 0 14.14-r0
Chainguard libpq-15 0 15.9-r0
Chainguard libpq-16 0 16.5-r0
Chainguard libpq-17 0 17.1-r0
Chainguard postgresql-12 0 12.21-r0
Chainguard postgresql-12-base 0 12.21-r0
Chainguard postgresql-12-bitnami-compat 0 12.21-r0
Chainguard postgresql-12-client 0 12.21-r0
Chainguard postgresql-12-client-base 0 12.21-r0
Chainguard postgresql-12-contrib 0 12.21-r0
Chainguard postgresql-12-dev 0 12.21-r0
Chainguard postgresql-12-oci-entrypoint 0 12.21-r0
Chainguard postgresql-12-oci-entrypoint-base 0 12.21-r0
Chainguard postgresql-12-pgadmin-compat 0 12.21-r0
Chainguard postgresql-13 0 13.17-r0
Chainguard postgresql-13-base 0 13.17-r0
Chainguard postgresql-13-bitnami-compat 0 13.17-r0
Chainguard postgresql-13-client 0 13.17-r0
Chainguard postgresql-13-client-base 0 13.17-r0
Chainguard postgresql-13-contrib 0 13.17-r0
Chainguard postgresql-13-dev 0 13.17-r0
Chainguard postgresql-13-oci-entrypoint 0 13.17-r0
Chainguard postgresql-13-oci-entrypoint-base 0 13.17-r0
Chainguard postgresql-13-pgadmin-compat 0 13.17-r0
Chainguard postgresql-14 0 14.14-r0
Chainguard postgresql-14-base 0 14.14-r0
Chainguard postgresql-14-bitnami-compat 0 14.14-r0
Chainguard postgresql-14-client 0 14.14-r0
Chainguard postgresql-14-client-base 0 14.14-r0
Chainguard postgresql-14-contrib 0 14.14-r0

Related vulnerabilities