CVE-2021-46659: MariaDB DoS Vulnerability

CVE-2021-46659 Overview

CVE-2021-46659 is a denial-of-service vulnerability in MariaDB versions before 10.7.2. The flaw exists because MariaDB does not recognize that SELECT_LEX::nest_level is local to each VIEW. An authenticated local attacker can trigger an application crash by submitting crafted SQL involving views. The issue affects MariaDB across multiple supported branches and was packaged for Fedora 34, 35, and 36 distributions.

Critical Impact
A low-privileged local user with database access can crash the MariaDB server, disrupting all databases hosted on the affected instance and producing service-wide availability loss.

Affected Products

MariaDB versions prior to 10.7.2
Fedora 34, 35, and 36 distributions packaging affected MariaDB builds
NetApp products bundling MariaDB (per advisory NTAP-20220311-0003)

Discovery Timeline

2022-01-29 - CVE-2021-46659 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-46659

Vulnerability Analysis

The vulnerability resides in the MariaDB SQL parser and query resolution logic. SELECT_LEX is the internal structure representing a single SELECT statement, and nest_level tracks subquery nesting depth during parsing and name resolution. The field is intended to be scoped per VIEW, since each view definition has its own independent nesting context.

MariaDB fails to treat nest_level as local to each VIEW, causing the server to mis-track nesting depth when queries reference views. When a crafted query touches a view boundary, the inconsistent state leads to an assertion failure or null dereference inside query processing. The result is termination of the mysqld server process and loss of availability for all clients.

This is a server-side reliability defect tracked as a denial-of-service issue. The classification maps to a generic input handling and resource state error; no specific CWE has been assigned by NVD (NVD-CWE-noinfo). Confidentiality and integrity are not affected, only availability.

Root Cause

The root cause is improper scoping of parser state. SELECT_LEX::nest_level should be reset or treated independently for each VIEW being expanded, but the affected MariaDB versions share or carry over the value across view boundaries. When the field reaches an unexpected value, downstream code paths violate internal invariants and crash. Details are documented in MariaDB JIRA Issue MDEV-25631.

Attack Vector

Exploitation requires authenticated local access to the database with sufficient privilege to create or query views. An attacker submits a malformed query referencing a view that triggers the inconsistent nest_level state. The server process aborts, denying service to all tenants on that instance. No remote unauthenticated path is documented, and no public proof-of-concept exploit is published.

The vulnerability is described in prose only. See MariaDB JIRA Issue MDEV-25631 for the upstream technical discussion and fix commit references.

Detection Methods for CVE-2021-46659

Indicators of Compromise

Unexpected mysqld process termination or restart events in system logs
MariaDB error log entries showing assertion failures or signal handlers triggered during VIEW query processing
Crash dumps or core files generated under the MariaDB data directory after view-related queries
Repeated client disconnects coinciding with crafted SELECT statements referencing views

Detection Strategies

Audit MariaDB version strings across all hosts and flag instances earlier than 10.7.2
Enable the MariaDB general query log temporarily to correlate crash timestamps with submitted SQL referencing views
Monitor process supervisors (systemd, Kubernetes) for repeated mysqld restarts within short intervals
Review database user privilege grants to identify accounts that can create views or execute arbitrary SQL

Monitoring Recommendations

Forward MariaDB error logs and system journal entries to a centralized log platform for alerting on crash signatures
Alert on any mysqld exit with non-zero status or signals such as SIGSEGV and SIGABRT
Track query latency and connection drop spikes that indicate server-side crash and restart cycles
Baseline normal view usage patterns to flag anomalous bursts of view-related queries from a single account

How to Mitigate CVE-2021-46659

Immediate Actions Required

Upgrade MariaDB to version 10.7.2 or later across all production and development instances
On Fedora 34, 35, and 36, install the patched MariaDB package via dnf update mariadb-server referencing the Fedora package announcements
Review and restrict privileges so only trusted accounts hold CREATE VIEW and broad SELECT rights
Confirm bundled MariaDB versions in third-party appliances, including NetApp products covered by NetApp Security Advisory NTAP-20220311-0003

Patch Information

The fix is included in MariaDB 10.7.2 and backported to maintained branches. Patch details and commit references are tracked in MariaDB JIRA Issue MDEV-25631. Fedora distributed updated packages through the Fedora Package Announcement. Refer to the MariaDB Security Knowledge Base for the full vendor advisory.

Workarounds

Revoke CREATE VIEW privileges from non-administrative accounts where business needs allow
Restrict network access to MariaDB instances using host-based firewall rules and bind to localhost when remote access is unnecessary
Place the database behind a connection proxy that can rate-limit or filter queries from untrusted accounts
Configure automated process supervision so mysqld restarts quickly after a crash, reducing outage duration until patching completes

bash

# Configuration example: Fedora patch application and privilege hardening
sudo dnf update mariadb-server
sudo systemctl restart mariadb

# Revoke view creation from a non-admin account
mysql -u root -p -e "REVOKE CREATE VIEW ON *.* FROM 'appuser'@'%'; FLUSH PRIVILEGES;"

# Verify installed version is 10.7.2 or later
mysql -V