CVE-2021-32029 Overview
CVE-2021-32029 is an information disclosure vulnerability in PostgreSQL. An authenticated database user can craft a specific table and issue an UPDATE ... RETURNING command to read arbitrary bytes of server memory. The flaw maps to [CWE-200] Information Exposure and [CWE-125] Out-of-Bounds Read. The highest threat is to data confidentiality, since leaked memory may contain credentials, query data, or other sensitive content from the PostgreSQL backend process. The vulnerability also affects Red Hat JBoss Enterprise Application Platform 7.0.0, which bundles affected PostgreSQL components.
Critical Impact
Authenticated database users can read arbitrary server memory contents, exposing sensitive data processed by the PostgreSQL backend.
Affected Products
- PostgreSQL (multiple versions prior to the fixed releases)
- Red Hat JBoss Enterprise Application Platform 7.0.0
- NetApp products bundling PostgreSQL (see NetApp advisory NTAP-20211112-0003)
Discovery Timeline
- 2021-10-08 - CVE-2021-32029 published to NVD
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2021-32029
Vulnerability Analysis
The vulnerability resides in PostgreSQL's handling of the UPDATE ... RETURNING clause against a purpose-crafted table. When the server processes the RETURNING projection, it reads tuple data using attribute metadata that an attacker can manipulate through specific table structures. The result is an out-of-bounds read that exposes bytes from the PostgreSQL backend process memory to the connected client.
Exploitation requires only an authenticated session with privileges to create or modify tables in a database, which is a common privilege level for application service accounts and shared hosting tenants. No user interaction is required, and the attack is conducted over the standard PostgreSQL network protocol.
Root Cause
The root cause is improper bounds checking when the RETURNING clause projects column values from a maliciously structured table. PostgreSQL trusts attribute descriptors that describe column lengths and offsets, allowing the read to cross the intended tuple boundary. This is the classic [CWE-125] out-of-bounds read pattern combined with [CWE-200] information exposure.
Attack Vector
An authenticated attacker connects to the PostgreSQL server and creates a table whose column definitions trigger the boundary error. The attacker then executes an UPDATE ... RETURNING statement against that table. The server returns memory bytes adjacent to the tuple buffer, which can include data from other sessions, cached query results, or sensitive configuration loaded into the backend process. Repeated execution can be used to sweep memory and reconstruct sensitive content.
No verified public proof-of-concept code is referenced in the advisory. See the PostgreSQL Security Advisory CVE-2021-32029 for the vendor's technical description.
Detection Methods for CVE-2021-32029
Indicators of Compromise
- Unexpected CREATE TABLE statements followed shortly by UPDATE ... RETURNING queries from non-administrative accounts.
- Database sessions returning unusually large or binary-looking values from RETURNING clauses on small tables.
- Application service accounts performing schema modifications outside of normal deployment windows.
Detection Strategies
- Enable PostgreSQL statement logging (log_statement = 'mod' or 'all') and review for UPDATE ... RETURNING queries against recently created tables.
- Audit role privileges to identify accounts with CREATE on schemas that should be read-only.
- Correlate database audit logs with application telemetry to flag queries that do not originate from approved application code paths.
Monitoring Recommendations
- Forward PostgreSQL logs to a centralized SIEM and alert on schema changes by application service accounts.
- Monitor for anomalous result-set sizes from RETURNING clauses, which can indicate memory disclosure attempts.
- Track PostgreSQL server version inventory to confirm patched builds are deployed across all clusters and replicas.
How to Mitigate CVE-2021-32029
Immediate Actions Required
- Upgrade PostgreSQL to a fixed minor release (13.3, 12.7, 11.12, 10.17, or 9.6.22 and later) as listed in the PostgreSQL Security Advisory CVE-2021-32029.
- Apply vendor patches for downstream products such as Red Hat JBoss EAP and NetApp appliances per the Red Hat Bug Report #1956883 and NetApp Security Advisory NTAP-20211112-0003.
- Review and reduce CREATE privileges granted to application and shared-tenant accounts.
Patch Information
PostgreSQL released coordinated security updates on May 13, 2021 across supported branches. Restart the database service after upgrading the binaries to ensure the patched code is loaded. Verify the running version with SELECT version(); after the upgrade.
Workarounds
- Revoke CREATE privilege on all schemas from untrusted roles using REVOKE CREATE ON SCHEMA public FROM PUBLIC; until patches are applied.
- Restrict database access to trusted application hosts using pg_hba.conf and network segmentation.
- Use separate PostgreSQL clusters for multi-tenant workloads to limit the scope of memory exposed to any single tenant.
# Configuration example: restrict table creation and verify patched version
psql -U postgres -c "REVOKE CREATE ON SCHEMA public FROM PUBLIC;"
psql -U postgres -c "SELECT version();"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
