CVE-2024-7348 describes a time-of-check to time-of-use (TOCTOU) race condition in the pg_dump utility of PostgreSQL. An attacker capable of creating objects in the database can exploit this by replacing a relation type with a view or foreign table during the dump process, causing arbitrary SQL functions to be executed as the user running pg_dump, which is often a superuser. The race condition is trivial to win if the attacker maintains an open transaction. Affected versions include all PostgreSQL releases before 12.20, 13.16, 14.13, 15.8, and 16.4. Red Hat has issued an important security advisory with patches for affected packages.

Successful exploitation allows an attacker with the ability to create objects in the database to execute arbitrary SQL commands with the privileges of the pg_dump user, which is typically a superuser. This could lead to unauthorized data access, modification, or other privileged actions within the database environment.

A patch is available and should be applied to affected PostgreSQL versions as soon as possible. Refer to the Red Hat advisory RHSA-2024:8495 and the PostgreSQL update channels for the appropriate security updates. No additional mitigation steps are required beyond applying the official fixes.