Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs). Supported versions that are affected are 5.5.61 and prior, 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. While the vulnerability is in MySQL Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. External References: http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
Created community-mysql tracking bugs for this issue: Affects: fedora-all [bug 1640559]
This apparently is a re-fix for what got CVE-2018-2773 in the April 2018 CPU. As explained in bug 1568932 comment 5, the issue that was fixed in MySQL was not what had originally been reported by Michael Orlitzky. The problem is that MySQL / MariaDB only write their pid to a pid file after dropping privileges, i.e. when running with mysql user privileges. Therefore, the pid file has to be writeable to that user. Consequently, the user can modify the file to contain pid of any process on the system. On systems where MySQL / MariaDB are started using SysV init script, that script is typically running kill with root privileges, resulting in arbitrary process getting killed during the service shutdown. As noted in bug 1568932 comment 6, the Red Hat MySQL and MariaDB packages for Red Hat Enterprise Linux 7 and Red Hat Software Collections for Red Hat Enterprise Linux 7 use systemd service units to start and stop mysqld, and those are not affected by this flaw.
MySQL upstream fixed this via this commit: https://github.com/mysql/mysql-server/commit/e1fdeb2468f3ee16e34e0c3af856edde128836e5 Equivalent MariaDB fix is here: https://github.com/MariaDB/server/commit/73e1ffdc6899aea69182c15930f712a178813660 The Red Hat MySQL and MariaDB packages for Red Hat Enterprise Linux 6 use custom init script and do not use those provide by either upstream.
Also see MariaDB bug for further details: https://jira.mariadb.org/browse/MDEV-13402
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS Via RHSA-2018:3655 https://access.redhat.com/errata/RHSA-2018:3655
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS Via RHSA-2019:1258 https://access.redhat.com/errata/RHSA-2019:1258