CVE-2024-6873: ClickHouse Server DoS Vulnerability

CVE-2024-6873 Overview

CVE-2024-6873 is a heap-based buffer overflow [CWE-122] in the ClickHouse server native interface. An unauthenticated attacker can send a specially crafted request to crash the ClickHouse server process or redirect its execution flow. The redirection is constrained to a 256-byte memory range available at execution time. According to the vendor, no known remote code execution exploit has been produced against this flaw. Fixes have been merged into all currently supported ClickHouse versions.

Critical Impact

Unauthenticated network attackers can crash the ClickHouse server or hijack execution flow within a limited 256-byte memory window via the native protocol interface.

Affected Products

• ClickHouse server (versions prior to the patched releases referenced in GHSA-432f-r822-j66f)
• Self-hosted ClickHouse deployments exposing the native interface
• Forked ClickHouse distributions that have not merged the upstream fix

Discovery Timeline

• 2024-08-01 - CVE-2024-6873 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-6873

Vulnerability Analysis

The vulnerability resides in the ClickHouse server native protocol handler. ClickHouse exposes a binary native interface (default TCP port 9000) for client-server communication. Processing of a malformed request triggers a heap-based buffer overflow, classified under [CWE-122]. The overflow corrupts adjacent heap memory used by the server process. Attackers can leverage the corruption to crash the process or alter control flow within a constrained range.

Root Cause

The defect stems from improper bounds checking during deserialization of incoming native protocol data. The server writes attacker-controlled data beyond an allocated heap buffer. The fix is contained in the upstream commit referenced by ClickHouse pull request #64024, which adds the missing length validation on the affected request path.

Attack Vector

Exploitation requires network access to the ClickHouse native interface and no authentication or user interaction. An attacker establishes a TCP connection to the native port and transmits a crafted protocol message that overruns the target heap buffer. The achievable control-flow redirection is limited to addresses reachable within 256 bytes of the corrupted memory region. This constraint reduces the likelihood of weaponized remote code execution but preserves a reliable denial-of-service primitive.

No verified proof-of-concept code is publicly available. See the GitHub Security Advisory GHSA-432f-r822-j66f for additional technical context.

Detection Methods for CVE-2024-6873

Indicators of Compromise

• Unexpected clickhouse-server process crashes or restarts coinciding with inbound traffic on TCP port 9000
• Core dumps or SIGSEGV entries in /var/log/clickhouse-server/clickhouse-server.err.log following malformed native protocol requests
• Connections to the native interface from untrusted source IP addresses without preceding authentication context

Detection Strategies

• Monitor ClickHouse server logs for abnormal termination messages, parser errors, and repeated client disconnects on the native port
• Deploy network signatures to flag malformed ClickHouse native protocol frames sent by unauthenticated clients
• Correlate process crash telemetry from endpoint sensors with concurrent inbound traffic on port 9000

Monitoring Recommendations

• Enable verbose query and connection logging on ClickHouse servers and forward logs to a centralized SIEM
• Alert on repeated clickhouse-server restarts within short time windows
• Track exposure of port 9000 to untrusted networks using external attack surface monitoring

How to Mitigate CVE-2024-6873

Immediate Actions Required

• Upgrade ClickHouse server to a patched release that includes the fix from pull request #64024
• Restrict network access to the native interface (TCP 9000) using firewall rules or security groups so only trusted clients can connect
• Audit ClickHouse deployments for unauthenticated network exposure, including forked or self-built binaries

Patch Information

ClickHouse has merged fixes for CVE-2024-6873 into all currently supported branches. Operators maintaining forks or running unsupported versions should backport the change from ClickHouse PR #64024. Full advisory details are available in GHSA-432f-r822-j66f.

Workarounds

• Place the ClickHouse native interface behind a VPN or bastion host and block direct internet exposure
• Require client TLS certificates on the native port to limit reachability to authenticated peers
• Disable the native interface and route traffic exclusively through the HTTP interface where operationally feasible

# Example: restrict ClickHouse native port to a trusted subnet
iptables -A INPUT -p tcp --dport 9000 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9000 -j DROP