diff options
| author | Alvaro Herrera | 2020-02-10 14:47:09 +0000 |
|---|---|---|
| committer | Alvaro Herrera | 2020-02-10 14:47:09 +0000 |
| commit | 2ad125322d5be8b264f2b0945d7dd23ba3ace60e (patch) | |
| tree | c5df44057ad948968abab7c058e05484d5c13775 | |
| parent | 326431670a876925d699e2be7a216a23ee2d32bf (diff) | |
Fix priv checks for ALTER <object> DEPENDS ON EXTENSION
Marking an object as dependant on an extension did not have any
privilege check whatsoever; this allowed any user to mark objects as
droppable by anyone able to DROP EXTENSION, which could be used to cause
system-wide havoc. Disallow by checking that the calling user owns the
mentioned object.
(No constraints are placed on the extension.)
Security: CVE-2020-1720
Reported-by: Tom Lane
Discussion: 31605.1566429043@sss.pgh.pa.us
| -rw-r--r-- | src/backend/commands/alter.c | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/src/backend/commands/alter.c b/src/backend/commands/alter.c index 562e3d3455c..40ca64e2261 100644 --- a/src/backend/commands/alter.c +++ b/src/backend/commands/alter.c @@ -440,6 +440,17 @@ ExecAlterObjectDependsStmt(AlterObjectDependsStmt *stmt, ObjectAddress *refAddre &rel, AccessExclusiveLock, false); /* + * Verify that the user is entitled to run the command. + * + * We don't check any privileges on the extension, because that's not + * needed. The object owner is stipulating, by running this command, that + * the extension owner can drop the object whenever they feel like it, + * which is not considered a problem. + */ + check_object_ownership(GetUserId(), + stmt->objectType, address, stmt->object, rel); + + /* * If a relation was involved, it would have been opened and locked. We * don't need the relation here, but we'll retain the lock until commit. */ |