CVE-2017-14798: high-severity vulnerability in suse postgresql-init
local privilege escalation in SUSE postgresql init script
Published · Updated
No sign of exploitation. It has a public proof of concept.
A timing flaw in the PostgreSQL startup script allows someone with access to the PostgreSQL account to gain root-level permissions. An attacker could exploit this race condition during system startup to escalate their privileges.
A race condition exists in the SUSE PostgreSQL init script (CWE-61) that can be exploited by an attacker with postgresql account access to achieve local privilege escalation to root. The vulnerability occurs during the initialization phase when file permissions or ownership are set, allowing a malicious user to manipulate the process flow and gain elevated privileges before proper access controls are enforced.