Описание
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted FRM file in the data directory could trigger out-of-bounds reads or writes, crash the server, or potentially execute code. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
A flaw was found in MariaDB. An attacker able to place a crafted table format (FRM) metadata file into the database data directory can exploit insufficient validation of metadata boundaries and field counts when the server opens the file. This could lead to out-of-bounds memory operations, potentially allowing arbitrary code execution or causing a Denial of Service (DoS) by crashing the database server.
Отчет
Red Hat has evaluated this vulnerability as Moderate because successful exploitation requires pre-existing privileged access to the database storage location on the host. Under standard Red Hat Enterprise Linux deployments, the database service directory is strictly confined to the dedicated system account and SELinux policies further restrict unauthorized file creation. Because an attacker must already possess high-level operating system rights or elevated database permissions to insert malicious table schema files, typical unauthenticated remote users cannot directly compromise the instance.
Меры по смягчению последствий
Upgrade to the fixed version of MariaDB Server
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | mariadb10.11 | Affected | ||
| Red Hat Enterprise Linux 10 | mariadb11.8 | Affected | ||
| Red Hat Enterprise Linux 7 | mariadb | Affected | ||
| Red Hat Enterprise Linux 8 | mariadb:10.11/mariadb | Affected | ||
| Red Hat Enterprise Linux 8 | mariadb:10.3/mariadb | Affected | ||
| Red Hat Enterprise Linux 8 | mariadb-devel:10.3/mariadb | Affected | ||
| Red Hat Enterprise Linux 9 | mariadb | Affected | ||
| Red Hat Enterprise Linux 9 | mariadb:10.11/mariadb | Affected | ||
| Red Hat Enterprise Linux 9 | mariadb:11.8/mariadb | Affected | ||
| Red Hat OpenStack Platform 13 (Queens) | mariadb | Out of support scope |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
6.7 Medium
CVSS3
Связанные уязвимости
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted FRM file in the data directory could trigger out-of-bounds reads or writes, crash the server, or potentially execute code. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted FRM file in the data directory could trigger out-of-bounds reads or writes, crash the server, or potentially execute code. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
MariaDB server is a community developed fork of MySQL server. From 10. ...
insufficient validation of binary frm data when opening a table
Уязвимость компонента FRM Metadata Handler системы управления базами данных MariaDB, позволяющая нарушителю выполнить произвольный код
EPSS
6.7 Medium
CVSS3