CVE-2021-46666: MariaDB DoS Vulnerability

CVE-2021-46666 Overview

CVE-2021-46666 is a Denial of Service vulnerability affecting MariaDB database server versions prior to 10.6.2. The vulnerability allows an application crash due to mishandling of a pushdown from a HAVING clause to a WHERE clause during SQL query processing. This improper handling can be triggered by authenticated local users with database access, potentially causing service disruption.

Critical Impact

Authenticated users can cause MariaDB server crashes through specially crafted SQL queries, leading to denial of service and potential disruption of dependent applications.

Affected Products

• MariaDB versions prior to 10.2.40
• MariaDB versions prior to 10.3.31
• MariaDB versions prior to 10.4.21
• MariaDB versions prior to 10.5.12
• MariaDB versions prior to 10.6.2

Discovery Timeline

• 2022-02-01 - CVE-2021-46666 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-46666

Vulnerability Analysis

This vulnerability is classified under CWE-617 (Reachable Assertion), which involves application logic that can reach a state causing an assertion failure and subsequent crash. In MariaDB, the query optimizer includes functionality to push down conditions from the HAVING clause to the WHERE clause when optimizing certain types of queries. This optimization is designed to improve query performance by filtering data earlier in the execution pipeline.

However, due to improper handling during this pushdown operation, certain malformed or edge-case queries can trigger an internal assertion failure or unhandled exception within the MariaDB server. When this condition is reached, the database server crashes, resulting in immediate denial of service for all connected clients and applications.

Root Cause

The root cause lies in the query optimization logic that handles the transformation of HAVING clause predicates into WHERE clause conditions. The code path fails to properly validate or handle specific edge cases during this transformation, leading to a reachable assertion (CWE-617). When the assertion condition is violated during query execution, the server terminates abnormally rather than gracefully handling the error condition.

Attack Vector

The attack requires local access and low privileges - an attacker needs valid database credentials to execute queries against the MariaDB server. The attacker crafts a SQL query with specific HAVING clause constructs that trigger the faulty optimization path during query compilation or execution.

The vulnerability exploitation mechanism involves crafting SQL queries with HAVING clauses that trigger the vulnerable pushdown optimization path. When the MariaDB query optimizer attempts to transform these clauses, it encounters an unhandled state that results in a server crash. Detailed technical information about the specific query patterns can be found in the MariaDB Issue Tracker Entry.

Detection Methods for CVE-2021-46666

Indicators of Compromise

• Unexpected MariaDB server crashes or restarts without apparent cause
• Error logs containing assertion failure messages related to query optimization
• Patterns of complex queries with unusual HAVING clause constructs preceding crashes
• Multiple database connection resets occurring simultaneously

Detection Strategies

• Monitor MariaDB error logs for assertion failure messages and abnormal termination signals
• Implement query logging to identify patterns of queries containing complex HAVING clauses
• Deploy database activity monitoring to detect unusual query patterns from authenticated users
• Configure process monitoring to alert on unexpected MariaDB daemon restarts

Monitoring Recommendations

• Enable MariaDB general query log during incident investigation to capture triggering queries
• Configure system-level process monitoring for mysqld or mariadbd process crashes
• Set up automated alerts for database availability monitoring with rapid detection thresholds
• Review authentication logs to correlate crashes with specific user sessions

How to Mitigate CVE-2021-46666

Immediate Actions Required

• Upgrade MariaDB to version 10.6.2 or later immediately
• For older release branches, upgrade to 10.5.12, 10.4.21, 10.3.31, or 10.2.40 depending on your deployment
• Review database user privileges and restrict access to only necessary accounts
• Implement query monitoring to detect potential exploitation attempts

Patch Information

MariaDB has released security patches addressing this vulnerability in multiple supported branches. The fix is included in MariaDB versions 10.2.40, 10.3.31, 10.4.21, 10.5.12, and 10.6.2 and later. Organizations should consult the MariaDB Security Knowledge Base for complete patch details and download links. Additional advisory information is available from NetApp Security Advisory NTAP-20220221-0002.

Workarounds

• Restrict database access to trusted users only until patching is complete
• Implement application-level query validation to reject potentially malicious HAVING clause constructs
• Consider deploying database connection pooling with query inspection capabilities
• Enable query timeout limits to minimize impact of any potential crash attempts

# Verify MariaDB version to check vulnerability status
mariadb --version

# Check current version via SQL
mysql -u admin -p -e "SELECT VERSION();"

# Review user privileges for potential restriction
mysql -u admin -p -e "SELECT user, host FROM mysql.user;"