CVE-2016-6663: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') (CWE-362)
value: Race condition in Oracle MySQL before 5.5.52, 5.6.x before 5.6.33, 5.7.x before 5.7.15, and 8.x before 8.0.1; MariaDB before 5.5.52, 10.0.x before 10.0.28, and 10.1.x before 10.1.18; Percona Server before 5.5.51-38.2, 5.6.x before 5.6.32-78-1, and 5.7.x before 5.7.14-8; and Percona XtraDB Cluster before 5.5.41-37.0, 5.6.x before 5.6.32-25.17, and 5.7.x before 5.7.14-26.17 allows local users with certain permissions to gain privileges by leveraging use of my_copystat by REPAIR TABLE to repair a MyISAM table.
CWE description: The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.
CVSS v3 base score: 7
Published: 2016-12-13T21:59Z
Repository: https://github.com/MariaDB/server
Language: C
Files changed: include/my_sys.h, mysys/my_redel.c, mysys/my_static.c, sql/mysqld.cc
Commit date: 2016-09-12 16:42:05 +0200
Commit message: don't use my_copystat in the server

it was supposed to be used in command-line tools only.
Different fix for 4e5473862e:

Bug#24388746: PRIVILEGE ESCALATION AND RACE CONDITION USING CREATE TABLE

Diff: diff --git a/include/my_sys.h b/include/my_sys.h
index 7e37fe598b..001769a0b7 100644
--- a/include/my_sys.h
+++ b/include/my_sys.h
@@ -1,7 +1,7 @@
 /* Copyright (c) 2000, 2013, Oracle and/or its affiliates.
-   Copyright (c) 2010, 2013, Monty Program Ab.
+   Copyright (c) 2010, 2016, Monty Program Ab.
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; version 2 of the License.
 
@@ -244,11 +244,11 @@ extern int my_umask_dir,
 extern my_bool my_use_symdir;
 
 extern ulong	my_default_record_cache_size;
 extern my_bool  my_disable_locking, my_disable_async_io,
                 my_disable_flush_key_blocks, my_disable_symlinks;
-extern my_bool my_disable_sync;
+extern my_bool my_disable_sync, my_disable_copystat_in_redel;
 extern char	wild_many,wild_one,wild_prefix;
 extern const char *charsets_dir;
 /* from default.c */
 extern const char *my_defaults_extra_file;
 extern const char *my_defaults_group_suffix;
diff --git a/mysys/my_redel.c b/mysys/my_redel.c
index b285bb25e2..e5e4f48d9d 100644
--- a/mysys/my_redel.c
+++ b/mysys/my_redel.c
@@ -1,7 +1,7 @@
-/*
-   Copyright (c) 2000, 2010, Oracle and/or its affiliates
+/* Copyright (c) 2000, 2010, Oracle and/or its affiliates
+   Copyright (c) 2009, 2016, MariaDB
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; version 2 of the License.
 
@@ -47,11 +47,12 @@ int my_redel(const char *org_name, const char *tmp_name,
   int error=1;
   DBUG_ENTER("my_redel");
   DBUG_PRINT("my",("org_name: '%s' tmp_name: '%s'  MyFlags: %d",
 		   org_name,tmp_name,MyFlags));
 
-  if (my_copystat(org_name,tmp_name,MyFlags) < 0)
+  if (!my_disable_copystat_in_redel &&
+      my_copystat(org_name,tmp_name,MyFlags) < 0)
     goto end;
   if (MyFlags & MY_REDEL_MAKE_BACKUP)
   {
     char name_buff[FN_REFLEN + MY_BACKUP_NAME_EXTRA_LENGTH];    
     my_create_backup_name(name_buff, org_name, backup_time_stamp);
diff --git a/mysys/my_static.c b/mysys/my_static.c
index fdc01b1248..48b1e5b8dd 100644
--- a/mysys/my_static.c
+++ b/mysys/my_static.c
@@ -97,10 +97,11 @@ void (*debug_sync_C_callback_ptr)(MYSQL_THD, const char *, size_t)= 0;
 my_bool my_disable_locking=0;
 my_bool my_disable_sync=0;
 my_bool my_disable_async_io=0;
 my_bool my_disable_flush_key_blocks=0;
 my_bool my_disable_symlinks=0;
+my_bool my_disable_copystat_in_redel=0;
 
 /*
   Note that PSI_hook and PSI_server are unconditionally
   (no ifdef HAVE_PSI_INTERFACE) defined.
   This is to ensure binary compatibility between the server and plugins,
diff --git a/sql/mysqld.cc b/sql/mysqld.cc
index 9b8f964629..be9e21d674 100644
--- a/sql/mysqld.cc
+++ b/sql/mysqld.cc
@@ -3453,10 +3453,11 @@ static int init_common_variables()
 
   sf_leaking_memory= 0; // no memory leaks from now on
 
   max_system_variables.pseudo_thread_id= (ulong)~0;
   server_start_time= flush_status_time= my_time(0);
+  my_disable_copystat_in_redel= 1;
 
   rpl_filter= new Rpl_filter;
   binlog_filter= new Rpl_filter;
   if (!rpl_filter || !binlog_filter)
   {

Vulnerable code:    Copyright (c) 2010, 2013, Monty Program Ab.
extern my_bool my_disable_sync;
/*
   Copyright (c) 2000, 2010, Oracle and/or its affiliates
  if (my_copystat(org_name,tmp_name,MyFlags) < 0)
Fixed code:    Copyright (c) 2010, 2016, Monty Program Ab.
extern my_bool my_disable_sync, my_disable_copystat_in_redel;
/* Copyright (c) 2000, 2010, Oracle and/or its affiliates
   Copyright (c) 2009, 2016, MariaDB
  if (!my_disable_copystat_in_redel &&
      my_copystat(org_name,tmp_name,MyFlags) < 0)
my_bool my_disable_copystat_in_redel=0;
  my_disable_copystat_in_redel= 1;