CVE-2017-3312: Medium severity Oracle MySQL vulnerability
MySQL versions 5.5.52, 5.6.33, and 5.7.15 corrected a flaw in the way error log file was handled by mysqldsafe script. The issue allows mysql system user to escalate their privileges to root, and got two CVE ids assigned - CVE-2016-6664 and CVE-2016-5617 - see bug 1386564.
The original fix was applied as part of the patch for another issue - CVE-2016-6662:
https://github.com/mysql/mysql-server/commit/684a165f28b3718160a3e4c5ebd18a465d85e97c
The fix attempted to prevent script from using touch/chown/chmod on the configured log file if it was a symbolic link. This fix was found to be incomplete and having the following issues:
- Fix was racy, and the race was quite easy to win. Changing ownership and mode of arbitrary files was still possible.
- After the fix, mysqldsafe no longer tried to change ownership or mode of the log file if it was symlink, but it still used the file for logging and written new log entries to it. This allowed arbitrary file corruption, at least.
- It was possible to set log-error to point to arbitrary file, bypassing symlinks checks added by the fix.
These additional problems were corrected in versions 5.5.54, 5.6.35, and 5.7.17:
Unsafe use of rm and chown in mysqldsafe could result in privilege escalation. chown now can be used only when the target directory is /var/log. An incompatible change is that if the directory for the Unix socket file is missing, it is no longer created; instead, an error occurs. Due to these changes, /bin/bash is required to run mysqldsafe on Solaris. /bin/sh is still used on other Unix/Linux platforms.
http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-54.html http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-35.html http://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-17.html
via the following commit:
https://github.com/mysql/mysql-server/commit/1f93f4381b60e3a8012ba36a4dec920416073759
This fix, however, effectively disables mysqldsafe's logging to file if the script is running as root.
Other sources
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Packaging). Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Server. CVSS v3.0 Base Score 6.7 (Confidentiality, Integrity and Availability impacts).
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mysqlto a version that resolves this vulnerability.Fixed in 5.5.54 - Upgrade
Upgrade
mysqlto a version that resolves this vulnerability.Fixed in 5.6.35 - Upgrade
Upgrade
mysqlto a version that resolves this vulnerability.Fixed in 5.7.17 - Upgrade
Upgrade
mysqlto a version that resolves this vulnerability.Patch CVE-2016-6662 - Compensating control
If running mysqld_safe on Solaris, ensure /bin/bash is used to run mysqld_safe (per text: due to incompatible changes, /bin/bash is required to run mysqld_safe on Solaris).
- Compensating control
Mitigate by preventing a low-privileged attacker (with logon to the infrastructure where MySQL Server executes) from having access that could exploit mysqld_safe error log file handling; reduce attacker logon capabilities to the host/instance where mysqld_safe runs (per text: difficult to exploit allows low privileged attacker with logon to compromise MySQL Server).
Event History
Frequently Asked Questions
What is the severity of CVE-2017-3312?
CVE-2017-3312 is considered a high severity vulnerability due to the potential for privilege escalation.
How do I fix CVE-2017-3312?
To mitigate CVE-2017-3312, you should upgrade MySQL to version 5.5.53, 5.6.34, or 5.7.16 or later.
Which MySQL versions are affected by CVE-2017-3312?
CVE-2017-3312 affects MySQL versions 5.5.52, 5.6.33, and 5.7.15.
What types of systems are impacted by CVE-2017-3312?
CVE-2017-3312 impacts MySQL running on various environments including Debian and MariaDB.
What are the implications of CVE-2017-3312?
The implications of CVE-2017-3312 include the risk of a mysql system user gaining root privileges, which poses a security risk.