Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-23884

donor uses invalid SST methods

Details

    Description

      during SST a joiner sends an sst method name to the donor. Donor then appends it to the "wsrep_sst_" string to get the name of the sst script to use, e.g. wsrep_sst_rsync. There is no validation or filtering here, so if the malicious joiner sends, for example, "rsync `rm -rf /`" the donor will execute that too.

      Attachments

        Issue Links

          relates to

          Bug - A problem which impairs or prevents the functions of the product. MDEV-31470 When set at runtime, wsrep_sst_method accepts any value

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed

          Activity

            Ascending order - Click to sort in descending order
            serg Sergei Golubchik created issue -
            serg Sergei Golubchik made changes -
            Field Original Value New Value
            Priority Major [ 3 ] Blocker [ 1 ]
            serg Sergei Golubchik made changes -
            Fix Version/s 10.5.6 [ 24508 ]
            Fix Version/s 10.4.15 [ 24507 ]
            Fix Version/s 10.3.25 [ 24506 ]
            Fix Version/s 10.2.34 [ 24505 ]
            Fix Version/s 10.1.47 [ 24510 ]
            Fix Version/s 10.2 [ 14601 ]
            Fix Version/s 10.1 [ 16100 ]
            Fix Version/s 10.3 [ 22126 ]
            Fix Version/s 10.4 [ 22408 ]
            Fix Version/s 10.5 [ 23123 ]
            serg Sergei Golubchik made changes -
            Resolution Fixed [ 1 ]
            Status Open [ 1 ] Closed [ 6 ]
            Aurelien_LEQUOY Aurélien LEQUOY made changes -
            Comment [ How to reproduce the problem ? ]
            Aurelien_LEQUOY Aurélien LEQUOY made changes -
            Comment [ I will be really interested because i have one problem of SST with one donor that I cannot explain and I don't understand why yet. ]
            serg Sergei Golubchik made changes -
            Description during SST a joiner sends an sst method name to the donor. Donor then appends it to the "wsrep_sst_" string to get the name of the sst script to use, e.g. wsrep_sst_rsync. There is no validation or filtering here, so if the malicious joiner sends, for example, "rsync `rm -rf /`" the donor will execute that too.
            serg Sergei Golubchik added a comment -

            CVE-2020-15180

            serg Sergei Golubchik added a comment - CVE-2020-15180
            serg Sergei Golubchik made changes -
            Workflow MariaDB v3 [ 114181 ] MariaDB v4 [ 158435 ]
            seppo Seppo Jaakola made changes -

            People

              serg Sergei Golubchik
              serg Sergei Golubchik
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.