Bug 1414429 (CVE-2017-3291)
| Summary: | CVE-2017-3291 mysql: unrestricted mysqld_safe's ledir (CPU Jan 2017) | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Tomas Hoger <thoger> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | apevec, avibelli, ayoung, chrisw, cvsbot-xmlrpc, databases-maint, dciabrin, duge, gsterlin, hhorak, jbalunas, jjoyce, jorton, jschluet, jshepherd, kbasil, kvolny, lhh, lpeer, markmc, mbayer, mburns, mmuzila, mschorm, rbryant, rrajasek, sclewis, slinaber, srevivo, tdecacqu, thoger, tjay, tkirby |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
It was discovered that the mysqld_safe script honored the ledir option value set in a MySQL configuration file. A user able to modify one of the MySQL configuration files could use this flaw to escalate their privileges to root.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-03-21 14:51:03 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1445517, 1445518, 1445533, 1445534, 1458933, 1463415, 1463416, 1463417, 1463418 | ||
| Bug Blocks: | 1414362 | ||
|
Description
Tomas Hoger
2017-01-18 13:30:49 UTC
Created mariadb tracking bugs for this issue: Affects: fedora-all [bug 1414387] Created community-mysql tracking bugs for this issue: Affects: fedora-all [bug 1414386] This issue has very limited impact on MySQL and MariaDB packages included in Red Hat Enterprise Linux 7 and Red Hat Software Collections for Red Hat Enterprise Linux 7, as mysqld_safe used to start MySQL or MariaDB database is run by systemd with mysql OS user privileges. Therefore, it does not allow mysql -> root privilege escalation. It may only allow local users different from mysql to escalate their privileges to the mysql OS user if they are able to write to one of the my.cnf files (e.g. by exploiting the CVE-2016-6662 issue). On Red Hat Enterprise Linux 6, privilege escalation to root is possible. Pre-requisite is that an attacker needs to have mysql OS user privileges, or ability to modify my.cnf. According to Oracle, this CVE also covers an insecure path use in mysqld_safe. This code tries to find my_print_defaults command: https://github.com/mysql/mysql-server/blob/mysql-5.6.34/scripts/mysqld_safe.sh#L466 It first tries relative to $MY_BASEDIR_VERSION, which can be set to $PWD: https://github.com/mysql/mysql-server/blob/mysql-5.6.34/scripts/mysqld_safe.sh#L402 If root runs mysqld_safe while their $PWD is /tmp, arbitrary code controlled by some unprivileged local (not necessarily mysql) user can be executed. Note that this issue is not exploitable when root user runs mysqld init script while their working directory is /tmp, as the init script used in Red Hat MySQL packages explicitly specifies --basedir when running mysqld_safe. The issue was fixed upstream in: https://github.com/mysql/mysql-server/commit/53230ba274a37fa13d65e802c6ef3766cd0c6d91#diff-144aa2f11374843c969d96b7b84247eaL397 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2017:2192 https://access.redhat.com/errata/RHSA-2017:2192 This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS Via RHSA-2017:2787 https://access.redhat.com/errata/RHSA-2017:2787 This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS Via RHSA-2017:2886 https://access.redhat.com/errata/RHSA-2017:2886 This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS Via RHSA-2018:0279 https://access.redhat.com/errata/RHSA-2018:0279 This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS Via RHSA-2018:0574 https://access.redhat.com/errata/RHSA-2018:0574 Acknowledgments: Name: Red Hat Product Security |