CVE-2024-41436: 
ClickHouse vulnerability analysis and mitigation

A buffer overflow vulnerability was discovered in ClickHouse version 24.3.3.102, specifically in the DB::evaluateConstantExpressionImpl component. The vulnerability was identified and reported by researchers from the BASS team at the School of Cyber Science and Technology at Beihang University (GitHub Issue).

The vulnerability occurs in the DB::evaluateConstantExpressionImpl component, which uses the old analyzer unconditionally. The issue stems from the component's failure to support the 'allow_experimental_analyzer' setting properly. When triggered, it can lead to a segmentation fault due to a NULL pointer read access (GitHub POC). The vulnerability has been assigned a CVSS v3.1 base score of 7.5 HIGH with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

The exploitation of this vulnerability can result in database crashes and denial of service attacks. When triggered, it causes the database to experience segmentation faults, potentially disrupting database operations and affecting service availability (GitHub POC).

The vulnerability can be triggered through specific SQL queries involving distributed tables. A proof of concept has been published demonstrating how the vulnerability can be exploited through carefully crafted INSERT operations into distributed tables (GitHub Issue).

A pull request has been created to address this vulnerability, suggesting that the DB::evaluateConstantExpressionImpl function should be rewritten to properly support the 'allow_experimental_analyzer' setting (GitHub Issue).