CVE-2024-41435: 
YugabyteDB vulnerability analysis and mitigation

YugabyteDB v2.21.1.0 was discovered to contain a buffer overflow vulnerability via the "insert into" parameter. The vulnerability was identified in September 2024 and affects the lifecycle management of TupleTableSlots used in SubPlans that were used in conjunction with a ValueScan (GitHub Issue, GitHub Gist).

The vulnerability exists in the lifecycle management of TupleTableSlots used in SubPlans (CASE WHEN(..) ... END) when used in conjunction with a ValueScan for inserting multiple rows. The issue was originally present in vanilla PostgreSQL 11.2, which YugabyteDB is currently based on. According to CISA-ADP, the vulnerability has a CVSS v3.1 base score of 7.5 HIGH with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

The buffer overflow vulnerability could lead to database crashes and denial of service attacks. When exploited, it causes the server to close connections unexpectedly and terminate abnormally before or while processing requests (GitHub Issue).

The vulnerability can be triggered through the execution of specific SQL statements using the 'insert into' command with SubPlans and ValueScan operations. The issue has been demonstrated to be exploitable in YugabyteDB version 2.21.1.0 (GitHub Gist).

The issue was fixed in a subsequent minor release of PostgreSQL 11, which YugabyteDB is based on. Users should update to the latest version that includes these fixes (GitHub Issue).