CVE-2021-46657: MariaDB DOS Vulnerability via ORDER BY

CVE-2021-46657 Overview

CVE-2021-46657 is a Denial of Service vulnerability affecting MariaDB database server. The vulnerability exists in the get_sort_by_table function, which can be exploited to cause an application crash through certain subquery uses of ORDER BY clauses. This flaw allows authenticated local users to disrupt database availability by crafting malicious SQL queries.

Critical Impact

Authenticated attackers with local access can crash the MariaDB database server, resulting in denial of service and potential data integrity issues for dependent applications.

Affected Products

• MariaDB versions before 10.2.41
• MariaDB versions before 10.3.32
• MariaDB versions before 10.4.22
• MariaDB versions before 10.5.13
• MariaDB versions before 10.6.2

Discovery Timeline

• 2022-01-29 - CVE CVE-2021-46657 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-46657

Vulnerability Analysis

The vulnerability resides in the get_sort_by_table function within MariaDB's query processing engine. When the database server processes certain SQL queries containing subqueries combined with ORDER BY clauses, the function fails to properly handle edge cases, leading to an uncontrolled application crash.

The flaw is triggered during the query optimization phase when MariaDB attempts to determine the sort order for query results. When a malformed or specifically crafted subquery is used in conjunction with an ORDER BY clause, the get_sort_by_table function encounters an unexpected state that results in the server process terminating unexpectedly.

This vulnerability primarily impacts database availability. While it does not allow for data exfiltration or unauthorized modification, the ability to crash the database server at will poses significant operational risks for production environments that rely on MariaDB for critical applications.

Root Cause

The root cause of this vulnerability stems from insufficient input validation and error handling within the get_sort_by_table function. When processing complex subquery constructs with ORDER BY clauses, the function does not adequately verify the integrity of internal data structures before accessing them, leading to a crash condition. The specific issue relates to how the query optimizer handles table references during sort operations when subqueries are involved.

Attack Vector

The attack vector requires local access to the database server with authenticated credentials. An attacker with database query privileges can craft SQL statements that exploit the vulnerable code path in get_sort_by_table. The attack is relatively straightforward to execute once an attacker has valid database credentials, as it only requires submitting a specially crafted SQL query containing a subquery with ORDER BY.

The vulnerability can be triggered through:

• Direct database connections using valid credentials
• Applications that pass user-controllable input to SQL queries without proper sanitization
• Stored procedures or functions that execute vulnerable query patterns

Since no code examples are available from verified sources, the vulnerability mechanism involves constructing SQL queries where subqueries are combined with ORDER BY clauses in ways that cause the get_sort_by_table function to fail. For technical details on the specific query patterns, refer to MariaDB Jira Issue MDEV-25629.

Detection Methods for CVE-2021-46657

Indicators of Compromise

• Unexpected MariaDB server crashes or restarts without apparent hardware or resource issues
• Database error logs showing crashes related to query processing or sort operations
• Increased frequency of connection failures from applications relying on MariaDB
• Abnormal SQL query patterns containing nested subqueries with ORDER BY clauses

Detection Strategies

• Monitor MariaDB error logs for crash events related to query execution and sort operations
• Implement query auditing to identify unusual subquery patterns with ORDER BY clauses
• Deploy database activity monitoring (DAM) solutions to detect anomalous query behavior
• Use SentinelOne's runtime protection to detect and alert on unexpected process terminations

Monitoring Recommendations

• Enable comprehensive MariaDB query logging to capture potentially malicious query patterns
• Set up alerting for database server crashes and automatic restart events
• Monitor database connection pool health and availability metrics
• Implement baseline analysis for normal query patterns to identify deviations

How to Mitigate CVE-2021-46657

Immediate Actions Required

• Upgrade MariaDB to version 10.6.2 or later to address this vulnerability
• For older branches, upgrade to 10.5.13, 10.4.22, 10.3.32, or 10.2.41 respectively
• Review database access controls and minimize privileges for non-essential accounts
• Audit applications for potential injection points that could allow crafted queries

Patch Information

MariaDB has released patched versions addressing this vulnerability. Organizations should upgrade to the following minimum versions based on their current branch:

• 10.6 branch: Upgrade to version 10.6.2 or later
• 10.5 branch: Upgrade to version 10.5.13 or later
• 10.4 branch: Upgrade to version 10.4.22 or later
• 10.3 branch: Upgrade to version 10.3.32 or later
• 10.2 branch: Upgrade to version 10.2.41 or later

For detailed patch information, refer to the MariaDB Security Knowledge Base and MariaDB Jira Issue MDEV-25629.

Workarounds

• Implement strict input validation on all database-facing applications to prevent malformed queries
• Use database firewalls or query filtering to block potentially malicious query patterns
• Restrict database access to trusted users and applications only
• Configure connection pooling with health checks to automatically recover from crashes
• Consider implementing high-availability configurations to minimize downtime impact

# Configuration example - Verify MariaDB version and upgrade
# Check current MariaDB version
mariadb --version

# For package-based installations, update to patched version
# Debian/Ubuntu
sudo apt update && sudo apt upgrade mariadb-server

# RHEL/CentOS
sudo yum update MariaDB-server

# Verify the upgrade was successful
mariadb --version