Bug 1640321 (CVE-2018-3174)
| Summary: | CVE-2018-3174 mysql: Init script calling kill with root privileges using pid from pidfile owned by mysql user (CPU Oct 2018) | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Tomas Hoger <thoger> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | apevec, chrisw, databases-maint, dciabrin, hhorak, jjanco, jjoyce, jorton, jschluet, jstanek, kbasil, kvolny, lhh, lpeer, markmc, mbayer, mburns, mkocka, mmuzila, mschorm, praiskup, rbryant, sclewis, slinaber, tdecacqu |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | mysql 5.5.62, mysql 5.6.42, mysql 5.7.24, mysql 8.0.13, mariadb 5.5.62, mariadb 10.3.11, mariadb 10.2.19, mariadb 10.1.37, mariadb 10.0.37 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-05-22 10:01:00 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1647940, 1647941, 1647942, 1651804, 1701259 | ||
| Bug Blocks: | 1640349 | ||
|
Description
Tomas Hoger
2018-10-17 20:29:01 UTC
Created community-mysql tracking bugs for this issue: Affects: fedora-all [bug 1640559] This apparently is a re-fix for what got CVE-2018-2773 in the April 2018 CPU. As explained in bug 1568932 comment 5, the issue that was fixed in MySQL was not what had originally been reported by Michael Orlitzky. The problem is that MySQL / MariaDB only write their pid to a pid file after dropping privileges, i.e. when running with mysql user privileges. Therefore, the pid file has to be writeable to that user. Consequently, the user can modify the file to contain pid of any process on the system. On systems where MySQL / MariaDB are started using SysV init script, that script is typically running kill with root privileges, resulting in arbitrary process getting killed during the service shutdown. As noted in bug 1568932 comment 6, the Red Hat MySQL and MariaDB packages for Red Hat Enterprise Linux 7 and Red Hat Software Collections for Red Hat Enterprise Linux 7 use systemd service units to start and stop mysqld, and those are not affected by this flaw. MySQL upstream fixed this via this commit: https://github.com/mysql/mysql-server/commit/e1fdeb2468f3ee16e34e0c3af856edde128836e5 Equivalent MariaDB fix is here: https://github.com/MariaDB/server/commit/73e1ffdc6899aea69182c15930f712a178813660 The Red Hat MySQL and MariaDB packages for Red Hat Enterprise Linux 6 use custom init script and do not use those provide by either upstream. Also see MariaDB bug for further details: https://jira.mariadb.org/browse/MDEV-13402 This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS Via RHSA-2018:3655 https://access.redhat.com/errata/RHSA-2018:3655 This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS Via RHSA-2019:1258 https://access.redhat.com/errata/RHSA-2019:1258 |