Уязвимость DoS атаки в MariaDB Server из-за некорректного освобождения блокировки в методе "xbstream_open"
Описание
MariaDB Server имеет уязвимость, связанную с DoS атакой. Проблема возникает в файле extra/mariabackup/ds_xbstream.cc, где в методе xbstream_open при ошибке (stream_ctxt->dest_file == NULL) блокировка не освобождается корректно. Это позволяет локальным пользователям вызвать взаимную блокировку (deadlock) и, как следствие, DoS атаку. Примечание: вендор считает, что это просто ошибка некорректной блокировки, а не уязвимость с негативными последствиями.
Затронутые версии ПО
- MariaDB Server до версии 10.7
Тип уязвимости
- Взаимная блокировка (deadlock)
- DoS атака
Ссылки
- PatchThird Party Advisory
- Issue TrackingPermissions RequiredThird Party Advisory
- Third Party Advisory
- PatchThird Party Advisory
- Issue TrackingPermissions RequiredThird Party Advisory
- Third Party Advisory
Уязвимые конфигурации
Одно из
EPSS
5.5 Medium
CVSS3
5.3 Medium
CVSS3
2.1 Low
CVSS2
Дефекты
Связанные уязвимости
MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_xbstream.cc, when an error occurs (stream_ctxt->dest_file == NULL) while executing the method xbstream_open, the held lock is not released correctly, which allows local users to trigger a denial of service due to the deadlock. Note: The vendor argues this is just an improper locking bug and not a vulnerability with adverse effects.
MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_xbstream.cc, when an error occurs (stream_ctxt->dest_file == NULL) while executing the method xbstream_open, the held lock is not released correctly, which allows local users to trigger a denial of service due to the deadlock. Note: The vendor argues this is just an improper locking bug and not a vulnerability with adverse effects.
MariaDB Server before 10.7 is vulnerable to Denial of Service. In extr ...
MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_xbstream.cc, when an error occurs (stream_ctxt->dest_file == NULL) while executing the method xbstream_open, the held lock is not released correctly, which allows local users to trigger a denial of service due to the deadlock.
EPSS
5.5 Medium
CVSS3
5.3 Medium
CVSS3
2.1 Low
CVSS2