Hi hackers, pg_stat_get_backend_subxact() does not check the caller's permissions. Every other function in the "Per-Backend Statistics Functions" table that reports what a session is doing calls HAS_PGSTAT_PERMISSIONS() first and returns NULL to a caller who may not see it. This one is the only exception.
I reported this to pgsql-security first. Michael Paquier replied that it is not a vulnerability, since the count and the flag are of no use to an unprivileged user, and suggested that a consistency fix on HEAD be discussed here. The patch: - adds the HAS_PGSTAT_PERMISSIONS() check, with a regression test that fails without it; - documents the rule above that table. The table says nothing about permissions today; the rule is only written down for the dynamic statistics views; - corrects one column name in the docs: subxact_overflow should be subxact_overflowed. pid, dbid, userid and idset stay open to everyone, and I think that is right: they leak nothing new, since pg_stat_get_activity() already hands datid, pid, usesysid and application_name to every caller before it reaches its permission check. subxact_count and subxact_overflowed are different. They are not columns of pg_stat_activity at all, so this function is the only way to read them, and today it is an unchecked one. Thanks, Shihao
0001-Make-pg_stat_get_backend_subxact-respect-statistics-.patch
Description: Binary data
