TimescaleDB versions up to 2.29.1 contain an out-of-bounds read vulnerability in the dictionary compression reverse row iterator component (tsl/src/compression/algorithms/dictionary.c). While the forward path validates the decoded index, the reverse path uses an assertion that is compiled out in release builds, resulting in no validation of the 64-bit Simple8b index. An attacker with DML privileges on a physical compressed relation can insert crafted data and perform a reverse-order scan, causing an out-of-bounds Datum to be returned to the client. This can lead to disclosure of backend memory, including the shared buffer pool, bypassing SQL access controls. The issue is tracked as CWE-129 (Improper Validation of Array Index) and CWE-125 (Out-of-bounds Read).

An attacker with data manipulation language (DML) access to a physical compressed relation in TimescaleDB can exploit this vulnerability to read out-of-bounds memory from the backend process. This memory disclosure can include sensitive backend data such as the shared buffer pool. The vulnerability bypasses normal SQL access controls because the out-of-bounds data is returned as a normal column value. There are no known exploits in the wild at this time.

A fix for this vulnerability is available in TimescaleDB as of commit 517c13e. Users should upgrade to a version that includes this commit to remediate the issue. Patch status is not explicitly confirmed in the provided data, so users should verify the vendor advisory or repository for the fixed version. Until patched, restrict DML access to trusted users and avoid using physical compressed relations with untrusted data.