CVE-2021-46667: MariaDB Integer Overflow DOS Vulnerability

CVE-2021-46667 Overview

CVE-2021-46667 is an integer overflow vulnerability in MariaDB versions prior to 10.6.5. The flaw exists within the sql_lex.cc file, where improper handling of integer values can trigger an overflow condition, ultimately leading to an application crash. This vulnerability affects database availability and could be exploited by authenticated local users to cause a denial of service condition.

Critical Impact

Local authenticated attackers can exploit this integer overflow vulnerability to crash the MariaDB database server, causing service disruption and potential data unavailability for dependent applications.

Affected Products

• MariaDB versions prior to 10.6.5
• Fedora 34, 35, and 36 (with affected MariaDB packages)
• Systems running NetApp products with vulnerable MariaDB versions

Discovery Timeline

• 2022-02-01 - CVE-2021-46667 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-46667

Vulnerability Analysis

This vulnerability is classified as CWE-190 (Integer Overflow or Wraparound). The flaw occurs within the SQL lexer component of MariaDB, specifically in the sql_lex.cc source file. When certain SQL operations are processed, the lexer fails to properly validate integer boundaries, allowing a numeric value to exceed the maximum storage capacity of its data type.

The vulnerability requires local access and low-privilege authentication to exploit. While it does not compromise data confidentiality or integrity, the availability impact is significant as successful exploitation results in a complete application crash, disrupting all database operations until the service is restarted.

Root Cause

The root cause of CVE-2021-46667 lies in insufficient bounds checking within the sql_lex.cc file's integer handling routines. When processing certain SQL statements or values, the code fails to verify that arithmetic operations on integer values will not exceed the maximum representable value for the data type. This oversight allows an integer overflow condition to occur, corrupting internal state and triggering a crash condition in the database server process.

Attack Vector

The attack vector for this vulnerability is local, requiring an authenticated user with the ability to execute SQL queries against the MariaDB server. An attacker with valid database credentials can craft specific SQL statements designed to trigger the integer overflow condition in the lexer. While the attacker needs local access and valid credentials, the complexity of exploitation is low once these prerequisites are met.

The vulnerability manifests during SQL parsing when the lexer processes numeric values that exceed safe integer bounds. Detailed technical information about the specific triggering conditions can be found in the MariaDB JIRA Issue MDEV-26350.

Detection Methods for CVE-2021-46667

Indicators of Compromise

• Unexpected MariaDB server crashes or restarts without apparent system resource issues
• Database error logs showing crashes originating from sql_lex.cc or related lexer components
• Core dump files indicating crashes in SQL parsing routines
• Repeated service unavailability correlated with specific user sessions or queries

Detection Strategies

• Monitor MariaDB error logs for crash signatures related to integer overflow or lexer failures
• Implement database audit logging to track queries that precede crash events
• Use SentinelOne Singularity Platform to detect anomalous process terminations of the MariaDB daemon
• Deploy query analysis tools to identify potentially malicious SQL patterns targeting integer boundaries

Monitoring Recommendations

• Enable MariaDB slow query log and general query log during investigation periods
• Configure process monitoring to alert on unexpected mysqld terminations
• Establish baseline metrics for database availability and alert on deviations
• Review authentication logs to identify accounts executing unusual query patterns

How to Mitigate CVE-2021-46667

Immediate Actions Required

• Upgrade MariaDB to version 10.6.5 or later to address the integer overflow vulnerability
• Review and restrict database user privileges to limit exposure to authenticated local attackers
• Implement database connection filtering to reduce attack surface
• Back up critical databases before applying patches

Patch Information

MariaDB has released patches addressing this vulnerability in version 10.6.5 and later releases. Organizations should update to the latest stable version of their MariaDB branch. Fedora users can obtain patched packages through the official Fedora package repositories. Additional security information is available through the MariaDB Security Knowledge Base.

For NetApp product users, refer to the NetApp Security Advisory NTAP-20220221-0002 for specific guidance on affected products and remediation steps.

Workarounds

• Restrict database access to only trusted users until patches can be applied
• Implement query filtering at the application layer to reject potentially malicious input
• Enable connection limits and rate limiting to reduce the impact of potential DoS attempts
• Consider running MariaDB in a containerized environment with automatic restart capabilities to minimize downtime

# Verify current MariaDB version
mariadb --version

# Update MariaDB on Fedora systems
sudo dnf update mariadb-server

# Restart MariaDB service after patching
sudo systemctl restart mariadb