In one created a MyISAM table with DATA_DIRECTORY or INDEX_DIRECTORY attributes (that is, with symlinks) mi_open() and mi_delete() used the pattern of
expand all symlinks with realpath()
verify that the true path isn't leading into a datadir
open (or, accordingly, delete) the file
This is race condition prone, one can change the symlink after it was expanded by realpath() but before the file is opened.
Sergei Golubchik
made changes -
2017-02-15 17:44
Field
Original Value
New Value
Summary
CREATE TABLE race condition
mi_open race condition
Sergei Golubchik
made changes -
2017-02-15 18:43
Status
Open
[ 1
]
In Progress
[ 3
]
Sergei Golubchik
made changes -
2017-02-16 10:35
Status
In Progress
[ 3
]
Stalled
[ 10000
]
Sergei Golubchik
made changes -
2017-02-21 11:02
Assignee
Sergei Golubchik
[ serg
]
Sergey Vojtovich
[ svoj
]
Status
Stalled
[ 10000
]
In Review
[ 10002
]
Sergey Vojtovich
made changes -
2017-02-22 09:14
Assignee
Sergey Vojtovich
[ svoj
]
Sergei Golubchik
[ serg
]
Status
In Review
[ 10002
]
Stalled
[ 10000
]
Sergei Golubchik
made changes -
2017-02-27 11:47
Fix Version/s
5.5.55
[ 22311
]
Fix Version/s
10.0.30
[ 22313
]
Fix Version/s
10.1.22
[ 22502
]
Fix Version/s
10.2.5
[ 22117
]
Fix Version/s
10.2
[ 14601
]
Fix Version/s
5.5
[ 15800
]
Fix Version/s
10.0
[ 16000
]
Fix Version/s
10.1
[ 16100
]
Resolution
Fixed
[ 1
]
Status
Stalled
[ 10000
]
Closed
[ 6
]
Sergei Golubchik
made changes -
2017-04-18 08:41
Remote Link
This issue links to "CVE-2017-3313 (Web Link)"
[ 27955
]
Sergei Golubchik
made changes -
2017-04-18 08:54
Description
In one created a MyISAM table with {{DATA_DIRECTORY}} or {{INDEX_DIRECTORY}} attributes (that is, with symlinks) {{mi_open()}} and {{mi_delete()}} used the pattern of
* expand all symlinks with {{realpath()}}
* verify that the true path isn't leading into a datadir
* open (or, accordingly, delete) the file
This is race condition prone, one can change the symlink after it was expanded by {{realpath()}} but before the file is opened.
Sergei Golubchik
made changes -
2021-12-06 21:44
Workflow
MariaDB v3
[ 79353
]
MariaDB v4
[ 151600
]
{"report":{"fcp":1511.5,"ttfb":426.80000019073486,"pageVisibility":"visible","entityId":59952,"key":"jira.project.issue.view-issue","isInitial":true,"threshold":1000,"elementTimings":{},"userDeviceMemory":8,"userDeviceProcessors":64,"apdex":0.5,"journeyId":"c5f54f02-cabf-4dd3-87fc-46e6df685ddd","navigationType":0,"readyForUser":1618.8999996185303,"redirectCount":0,"resourceLoadedEnd":1205.8999996185303,"resourceLoadedStart":433.1000003814697,"resourceTiming":[{"duration":113.69999980926514,"initiatorType":"link","name":"https://jira.mariadb.org/s/2c21342762a6a02add1c328bed317ffd-CDN/lu2cib/820016/12ta74/0a8bac35585be7fc6c9cc5a0464cd4cf/_/download/contextbatch/css/_super/batch.css","startTime":433.1000003814697,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":433.1000003814697,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":546.8000001907349,"responseStart":0,"secureConnectionStart":0},{"duration":114,"initiatorType":"link","name":"https://jira.mariadb.org/s/7ebd35e77e471bc30ff0eba799ebc151-CDN/lu2cib/820016/12ta74/2bf333562ca6724060a9d5f1535471f6/_/download/contextbatch/css/jira.browse.project,project.issue.navigator,jira.view.issue,jira.general,jira.global,atl.general,-_super/batch.css?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&slack-enabled=true","startTime":433.3999996185303,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":433.3999996185303,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":547.3999996185303,"responseStart":0,"secureConnectionStart":0},{"duration":408.8999996185303,"initiatorType":"script","name":"https://jira.mariadb.org/s/0917945aaa57108d00c5076fea35e069-CDN/lu2cib/820016/12ta74/0a8bac35585be7fc6c9cc5a0464cd4cf/_/download/contextbatch/js/_super/batch.js?locale=en","startTime":433.5,"connectEnd":433.5,"connectStart":433.5,"domainLookupEnd":433.5,"domainLookupStart":433.5,"fetchStart":433.5,"redirectEnd":0,"redirectStart":0,"requestStart":550.3000001907349,"responseEnd":842.3999996185303,"responseStart":563.1000003814697,"secureConnectionStart":433.5},{"duration":749,"initiatorType":"script","name":"https://jira.mariadb.org/s/2d8175ec2fa4c816e8023260bd8c1786-CDN/lu2cib/820016/12ta74/2bf333562ca6724060a9d5f1535471f6/_/download/contextbatch/js/jira.browse.project,project.issue.navigator,jira.view.issue,jira.general,jira.global,atl.general,-_super/batch.js?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&locale=en&slack-enabled=true","startTime":433.69999980926514,"connectEnd":433.69999980926514,"connectStart":433.69999980926514,"domainLookupEnd":433.69999980926514,"domainLookupStart":433.69999980926514,"fetchStart":433.69999980926514,"redirectEnd":0,"redirectStart":0,"requestStart":553.1999998092651,"responseEnd":1182.6999998092651,"responseStart":566.3000001907349,"secureConnectionStart":433.69999980926514},{"duration":136.60000038146973,"initiatorType":"script","name":"https://jira.mariadb.org/s/a9324d6758d385eb45c462685ad88f1d-CDN/lu2cib/820016/12ta74/c92c0caa9a024ae85b0ebdbed7fb4bd7/_/download/contextbatch/js/atl.global,-_super/batch.js?locale=en","startTime":433.8999996185303,"connectEnd":433.8999996185303,"connectStart":433.8999996185303,"domainLookupEnd":433.8999996185303,"domainLookupStart":433.8999996185303,"fetchStart":433.8999996185303,"redirectEnd":0,"redirectStart":0,"requestStart":553.6999998092651,"responseEnd":570.5,"responseStart":568.6000003814697,"secureConnectionStart":433.8999996185303},{"duration":136.69999980926514,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2cib/820016/12ta74/1.0/_/download/batch/jira.webresources:calendar-en/jira.webresources:calendar-en.js","startTime":434.1000003814697,"connectEnd":434.1000003814697,"connectStart":434.1000003814697,"domainLookupEnd":434.1000003814697,"domainLookupStart":434.1000003814697,"fetchStart":434.1000003814697,"redirectEnd":0,"redirectStart":0,"requestStart":554.1000003814697,"responseEnd":570.8000001907349,"responseStart":569.1999998092651,"secureConnectionStart":434.1000003814697},{"duration":140.60000038146973,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2cib/820016/12ta74/1.0/_/download/batch/jira.webresources:calendar-localisation-moment/jira.webresources:calendar-localisation-moment.js","startTime":434.3999996185303,"connectEnd":434.3999996185303,"connectStart":434.3999996185303,"domainLookupEnd":434.3999996185303,"domainLookupStart":434.3999996185303,"fetchStart":434.3999996185303,"redirectEnd":0,"redirectStart":0,"requestStart":556.8000001907349,"responseEnd":575,"responseStart":572.8999996185303,"secureConnectionStart":434.3999996185303},{"duration":118.5,"initiatorType":"link","name":"https://jira.mariadb.org/s/b04b06a02d1959df322d9cded3aeecc1-CDN/lu2cib/820016/12ta74/a2ff6aa845ffc9a1d22fe23d9ee791fc/_/download/contextbatch/css/jira.global.look-and-feel,-_super/batch.css","startTime":434.5,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":434.5,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":553,"responseStart":0,"secureConnectionStart":0},{"duration":140.60000038146973,"initiatorType":"script","name":"https://jira.mariadb.org/rest/api/1.0/shortcuts/820016/47140b6e0a9bc2e4913da06536125810/shortcuts.js?context=issuenavigation&context=issueaction","startTime":434.69999980926514,"connectEnd":434.69999980926514,"connectStart":434.69999980926514,"domainLookupEnd":434.69999980926514,"domainLookupStart":434.69999980926514,"fetchStart":434.69999980926514,"redirectEnd":0,"redirectStart":0,"requestStart":557.5,"responseEnd":575.3000001907349,"responseStart":573.5,"secureConnectionStart":434.69999980926514},{"duration":122.19999980926514,"initiatorType":"link","name":"https://jira.mariadb.org/s/3ac36323ba5e4eb0af2aa7ac7211b4bb-CDN/lu2cib/820016/12ta74/d176f0986478cc64f24226b3d20c140d/_/download/contextbatch/css/com.atlassian.jira.projects.sidebar.init,-_super,-project.issue.navigator,-jira.view.issue/batch.css?jira.create.linked.issue=true","startTime":434.80000019073486,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":434.80000019073486,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":557,"responseStart":0,"secureConnectionStart":0},{"duration":226.30000019073486,"initiatorType":"script","name":"https://jira.mariadb.org/s/5d5e8fe91fbc506585e83ea3b62ccc4b-CDN/lu2cib/820016/12ta74/d176f0986478cc64f24226b3d20c140d/_/download/contextbatch/js/com.atlassian.jira.projects.sidebar.init,-_super,-project.issue.navigator,-jira.view.issue/batch.js?jira.create.linked.issue=true&locale=en","startTime":435,"connectEnd":435,"connectStart":435,"domainLookupEnd":435,"domainLookupStart":435,"fetchStart":435,"redirectEnd":0,"redirectStart":0,"requestStart":559.5,"responseEnd":661.3000001907349,"responseStart":652.5,"secureConnectionStart":435},{"duration":767.3999996185303,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2cib/820016/12ta74/1.0/_/download/batch/jira.webresources:bigpipe-js/jira.webresources:bigpipe-js.js","startTime":436.1000003814697,"connectEnd":436.1000003814697,"connectStart":436.1000003814697,"domainLookupEnd":436.1000003814697,"domainLookupStart":436.1000003814697,"fetchStart":436.1000003814697,"redirectEnd":0,"redirectStart":0,"requestStart":737.6000003814697,"responseEnd":1203.5,"responseStart":1195.1000003814697,"secureConnectionStart":436.1000003814697},{"duration":764.8999996185303,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2cib/820016/12ta74/1.0/_/download/batch/jira.webresources:bigpipe-init/jira.webresources:bigpipe-init.js","startTime":441,"connectEnd":441,"connectStart":441,"domainLookupEnd":441,"domainLookupStart":441,"fetchStart":441,"redirectEnd":0,"redirectStart":0,"requestStart":923.5,"responseEnd":1205.8999996185303,"responseStart":1200.3000001907349,"secureConnectionStart":441},{"duration":237.5,"initiatorType":"xmlhttprequest","name":"https://jira.mariadb.org/rest/webResources/1.0/resources","startTime":998.8999996185303,"connectEnd":998.8999996185303,"connectStart":998.8999996185303,"domainLookupEnd":998.8999996185303,"domainLookupStart":998.8999996185303,"fetchStart":998.8999996185303,"redirectEnd":0,"redirectStart":0,"requestStart":1203.6999998092651,"responseEnd":1236.3999996185303,"responseStart":1235.3999996185303,"secureConnectionStart":998.8999996185303},{"duration":377.30000019073486,"initiatorType":"xmlhttprequest","name":"https://jira.mariadb.org/rest/webResources/1.0/resources","startTime":1443.8999996185303,"connectEnd":1443.8999996185303,"connectStart":1443.8999996185303,"domainLookupEnd":1443.8999996185303,"domainLookupStart":1443.8999996185303,"fetchStart":1443.8999996185303,"redirectEnd":0,"redirectStart":0,"requestStart":1787.5,"responseEnd":1821.1999998092651,"responseStart":1819.6000003814697,"secureConnectionStart":1443.8999996185303}],"fetchStart":0,"domainLookupStart":0,"domainLookupEnd":0,"connectStart":0,"connectEnd":0,"requestStart":222,"responseStart":427,"responseEnd":434,"domLoading":431,"domInteractive":1737,"domContentLoadedEventStart":1737,"domContentLoadedEventEnd":1813,"domComplete":2302,"loadEventStart":2302,"loadEventEnd":2303,"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","marks":[{"name":"bigPipe.sidebar-id.start","time":1691.1999998092651},{"name":"bigPipe.sidebar-id.end","time":1692.1999998092651},{"name":"bigPipe.activity-panel-pipe-id.start","time":1692.3999996185303},{"name":"bigPipe.activity-panel-pipe-id.end","time":1696.8999996185303},{"name":"activityTabFullyLoaded","time":1873.3000001907349}],"measures":[],"correlationId":"1aa9bbd355b872","effectiveType":"4g","downlink":9.8,"rtt":0,"serverDuration":139,"dbReadsTimeInMs":20,"dbConnsTimeInMs":28,"applicationHash":"9d11dbea5f4be3d4cc21f03a88dd11d8c8687422","experiments":[]}}
svoj, could you please review the final fix? It's a set of commits, the complete diff is
git diff bb-5.5-serg^{/DEBUG_SYNC}..bb-5.5-serg^{/my_delete_with_symlink}
and you can look at individual commits with
gitk bb-5.5-serg^{/DEBUG_SYNC}..bb-5.5-serg^{/my_delete_with_symlink}
The main one is "
MDEV-11902mi_open race condition" and the four topmost ones (about my_delete).