Bug 1640321 (CVE-2018-3174) - CVE-2018-3174 mysql: Init script calling kill with root privileges using pid from pidfile owned by mysql user (CPU Oct 2018)
Summary: CVE-2018-3174 mysql: Init script calling kill with root privileges using pid ...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2018-3174
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1647940 1647941 1647942 1651804 1701259
Blocks: 1640349
TreeView+ depends on / blocked
 
Reported: 2018-10-17 20:29 UTC by Tomas Hoger
Modified: 2021-02-26 04:21 UTC (History)
25 users (show)

Fixed In Version: mysql 5.5.62, mysql 5.6.42, mysql 5.7.24, mysql 8.0.13, mariadb 5.5.62, mariadb 10.3.11, mariadb 10.2.19, mariadb 10.1.37, mariadb 10.0.37
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-05-22 10:01:00 UTC


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Bugzilla 1651244 1 None None None 2021-01-20 06:05:38 UTC
Red Hat Product Errata RHSA-2018:3655 0 None None None 2018-11-26 12:35:56 UTC
Red Hat Product Errata RHSA-2019:1258 0 None None None 2019-05-21 19:55:21 UTC

Internal Links: 1651244

Description Tomas Hoger 2018-10-17 20:29:01 UTC
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs). Supported versions that are affected are 5.5.61 and prior, 5.6.41 and prior, 5.7.23 and prior and  8.0.12 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. While the vulnerability is in MySQL Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.

External References:

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

Comment 1 Tomas Hoger 2018-10-18 10:22:28 UTC
Created community-mysql tracking bugs for this issue:

Affects: fedora-all [bug 1640559]

Comment 5 Tomas Hoger 2018-11-08 15:03:43 UTC
This apparently is a re-fix for what got CVE-2018-2773 in the April 2018 CPU.  As explained in bug 1568932 comment 5, the issue that was fixed in MySQL was not what had originally been reported by Michael Orlitzky.

The problem is that MySQL / MariaDB only write their pid to a pid file after dropping privileges, i.e. when running with mysql user privileges.  Therefore, the pid file has to be writeable to that user.  Consequently, the user can modify the file to contain pid of any process on the system.  On systems where MySQL / MariaDB are started using SysV init script, that script is typically running kill with root privileges, resulting in arbitrary process getting killed during the service shutdown.

As noted in bug 1568932 comment 6, the Red Hat MySQL and MariaDB packages for Red Hat Enterprise Linux 7 and Red Hat Software Collections for Red Hat Enterprise Linux 7 use systemd service units to start and stop mysqld, and those are not affected by this flaw.

Comment 6 Tomas Hoger 2018-11-08 15:06:26 UTC
MySQL upstream fixed this via this commit:

https://github.com/mysql/mysql-server/commit/e1fdeb2468f3ee16e34e0c3af856edde128836e5

Equivalent MariaDB fix is here:

https://github.com/MariaDB/server/commit/73e1ffdc6899aea69182c15930f712a178813660

The Red Hat MySQL and MariaDB packages for Red Hat Enterprise Linux 6 use custom init script and do not use those provide by either upstream.

Comment 10 Tomas Hoger 2018-11-08 15:53:06 UTC
Also see MariaDB bug for further details:

https://jira.mariadb.org/browse/MDEV-13402

Comment 14 errata-xmlrpc 2018-11-26 12:35:44 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS

Via RHSA-2018:3655 https://access.redhat.com/errata/RHSA-2018:3655

Comment 25 errata-xmlrpc 2019-05-21 19:55:19 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS

Via RHSA-2019:1258 https://access.redhat.com/errata/RHSA-2019:1258


Note You need to log in before you can comment on or make changes to this bug.