CVE-2024-6873

What it actually does

Unauthenticated memory corruption in the ClickHouse native interface allowing process crash or limited execution flow redirection within a 256-byte memory window.

Why it matters to the business

Disruption to database availability and potential for targeted service interruption without authentication.

How an attack unfolds

An attacker crafts a malicious request to the ClickHouse server's native interface, triggering memory corruption that can crash the server or redirect execution flow within a constrained 256-byte range.

How to fix it

Upgrade to a supported version with the fix merged. For custom forks, apply the patch from the referenced commit.

How to confirm the fix worked

Verify server version is updated and test connectivity to native interface with standard clients.

Typical attack path

1. Send specially crafted request to native interface port
2. Trigger memory corruption leading to crash or limited redirection
3. Observe impact on server process

How to detect it

Monitor server logs for unexpected crashes or errors related to the native protocol handler; inspect network traffic to the native port for anomalous requests.

What your security team should do

• Apply available fixes immediately
• Restrict access to native interface
• Monitor for server crashes