CVE-2021-46665: MariaDB DOS Vulnerability

CVE-2021-46665 Overview

CVE-2021-46665 is a Denial of Service vulnerability affecting MariaDB through version 10.5.9. The vulnerability exists in the sql_parse.cc component and occurs due to incorrect used_tables expectations during SQL query parsing. An authenticated local attacker can exploit this flaw to cause the MariaDB server to crash, resulting in service disruption for legitimate users and applications relying on the database.

Critical Impact

Successful exploitation allows an authenticated attacker to crash the MariaDB database server, causing denial of service to all connected applications and users.

Affected Products

• MariaDB versions through 10.5.9
• Fedora 34
• Fedora 35
• Fedora 36

Discovery Timeline

• 2022-02-01 - CVE-2021-46665 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-46665

Vulnerability Analysis

This vulnerability is a Denial of Service flaw stemming from incorrect handling of used_tables expectations within MariaDB's SQL parser component (sql_parse.cc). The parser fails to properly validate or handle certain table reference conditions during query processing, leading to an application crash when specific malformed or unexpected input is processed.

The vulnerability requires local access and authenticated privileges, meaning an attacker must have valid database credentials to exploit this issue. While the confidentiality and integrity of data are not directly compromised, the availability impact is significant as it can bring down the entire database service.

Root Cause

The root cause lies in the sql_parse.cc file where the SQL parser makes assumptions about used_tables data structures that may not hold true under all circumstances. When these expectations are violated, the parser encounters an error condition that is not properly handled, resulting in an uncontrolled application crash rather than graceful error recovery. This represents a failure in defensive programming practices within the SQL parsing logic.

Attack Vector

The attack vector is local, requiring authenticated access to the MariaDB database server. An attacker with valid database credentials can craft and execute specific SQL queries designed to trigger the incorrect used_tables handling in the parser. When the vulnerable code path is executed, the database server crashes, denying service to all other users and applications.

The vulnerability mechanism involves sending specially crafted SQL queries that exploit the parser's incorrect assumptions about table references. For detailed technical information, refer to the MariaDB Jira Issue MDEV-25636 which tracks this specific issue.

Detection Methods for CVE-2021-46665

Indicators of Compromise

• Unexpected MariaDB server crashes or restarts without clear cause
• Database service interruptions coinciding with specific user queries
• Error logs showing crashes in sql_parse.cc or related parser components
• Repeated authentication attempts followed by immediate service failures

Detection Strategies

• Monitor MariaDB error logs for crash reports mentioning sql_parse.cc or used_tables errors
• Implement query logging and analysis to identify anomalous SQL patterns preceding crashes
• Use database activity monitoring tools to track queries from authenticated users
• Configure crash dump analysis to identify exploitation patterns

Monitoring Recommendations

• Enable MariaDB general query logging to capture potentially malicious queries
• Set up automated alerts for unexpected database service restarts
• Monitor system logs for MariaDB process termination signals
• Implement connection tracking to correlate crashes with specific user sessions

How to Mitigate CVE-2021-46665

Immediate Actions Required

• Upgrade MariaDB to a patched version beyond 10.5.9
• Review and restrict database user privileges to only those necessary
• Implement network segmentation to limit local access to database servers
• Enable enhanced logging to detect potential exploitation attempts

Patch Information

MariaDB has addressed this vulnerability in versions released after 10.5.9. Organizations should consult the MariaDB Security Overview for the latest security updates and patching guidance. The specific issue is tracked in MariaDB Jira Issue MDEV-25636.

For Fedora users, security updates are available through standard package management channels. Refer to the Fedora Package Announcements for distribution-specific update instructions.

Workarounds

• Restrict database access to only trusted, authenticated users with legitimate business needs
• Implement strict input validation at the application layer before queries reach the database
• Deploy database activity monitoring to detect and block suspicious query patterns
• Consider implementing query complexity limits where supported

# Configuration example - Restrict user privileges in MariaDB
# Connect as administrator and review/restrict user privileges
mysql -u root -p -e "SELECT user, host FROM mysql.user;"

# Revoke unnecessary privileges from users
# REVOKE ALL PRIVILEGES ON *.* FROM 'username'@'host';
# GRANT SELECT, INSERT, UPDATE ON database.* TO 'username'@'host';

# Enable general query logging for monitoring
# Add to my.cnf:
# general_log = 1
# general_log_file = /var/log/mysql/query.log