Bug 717977

Summary:	mysql: Assertion failure when running SHOW CREATE TABLE statement on InnoDB table upon server restart (MySQL bug#55277)
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	byte, tgl
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-02-14 14:24:21 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Bug Depends On:
Bug Blocks:	717721

Description Jan Lieskovsky 2011-06-30 15:07:43 UTC

An assertion failure was found in the way MySQL server processed certain SQL queries, containing SHOW CREATE TABLE statement and referencing InnoDB storage engine table with the auto-increment column, when such queries were run upon server restart. A remote attacker, valid SQL user could use this flaw to cause denial of service (mysqld daemon abort due assertion failure).

References:
[1] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-52.html
[2] http://bugs.mysql.com/bug.php?id=55277
[3] http://lists.mysql.com/commits/119960?f=plain

Note:
On Red Hat Enterprise Linux systems mysqld daemon is not compiled with built-in assertion checks support, thus as such would not be affected by this issue.

Comment 1 Jan Lieskovsky 2011-06-30 15:09:32 UTC

Public PoC from [2]:
====================

How to repeat:
drop table if exists t1;
create table t1(a bigint unsigned not null auto_increment primary key)engine=innodb;
insert into t1 values (null);
insert into t1 values (18446744073709551615);

#restart server

show create table t1;

Comment 3 Jan Lieskovsky 2011-06-30 15:11:43 UTC

This issue does NOT affect the versions of the mysql package, as shipped with
Red Hat Enterprise Linux 4, 5, and 6.

--

This issue does NOT affect the version of the mysql package, as shipped with
Fedora release of 14 and 15.

Comment 10 Tomas Hoger 2011-07-11 16:54:54 UTC

(In reply to comment #0)
> [3] http://lists.mysql.com/commits/119960?f=plain

Not very good as a commit link, this should be better:
http://bazaar.launchpad.net/~mysql/mysql-server/mysql-5.1/revision/3477

Comment 11 Jan Lieskovsky 2011-07-11 17:15:32 UTC

(In reply to comment #10)
> (In reply to comment #0)
> > [3] http://lists.mysql.com/commits/119960?f=plain
> 

Wasn't intended to be a link to patch (rather reference to test case,
since upstream report 1) either doesn't have one 2) isn't accessible at
all). But you are right, the one below looks better.

> Not very good as a commit link, this should be better:
> http://bazaar.launchpad.net/~mysql/mysql-server/mysql-5.1/revision/3477