CVE-2017-15365 (published 2018-01-25T16:29Z)

sql/event_data_objects.cc in MariaDB before 10.1.30 and 10.2.x before 10.2.10 and Percona XtraDB Cluster before 5.6.37-26.21-3 and 5.7.x before 5.7.19-29.22-3 allows remote authenticated users with SQL access to bypass intended access restrictions and replicate data definition language (DDL) statements to cluster nodes by leveraging incorrect ordering of DDL replication and ACL checking.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/MariaDB/server
commit_details: repo_url: https://github.com/MariaDB/server
author: sjaakola
author_date: 2017-10-06 09:49:42+03:00
msg: MW-416 DDL replication moved after acl checking

galera_events test shows a regression with the original fix for MW-416
Reason was that Events::drop_event() can be called also from inside event
execution, and there we have a speacial treatment for event, which executes
"DROP EVENT" statement, and runs TOI replication inside the event processing body.
This resulted in executing WSREP_TO_ISOLATION two times for such DROP EVENT statement.
Fix is to call WSREP_TO_ISOLATION_BEGIN only in Events::drop_event()
repository: repo_url: https://github.com/MariaDB/server
repo_name: MariaDB/server
description: MariaDB server is a community developed fork of MySQL server. Started by core members of the original MySQL team, MariaDB actively works with outside developers to deliver the most featureful, stable, and sanely licensed open SQL server in the industry.
repo_language: C++
owner: MariaDB
file_changes: filename: event_data_objects.cc
change_type: ModificationType.MODIFY
diff: @@ -1472,19 +1472,33 @@ Event_job_data::execute(THD *thd, bool drop)
       bool save_tx_read_only= thd->tx_read_only;
       thd->tx_read_only= false;
 
-      if (WSREP(thd))
-      {
+      /*
+         This code is processing event execution and does not have client
+         connection. Here, event execution will now execute a prepared
+         DROP EVENT statement, but thd->lex->sql_command is set to
+         SQLCOM_CREATE_PROCEDURE
+         DROP EVENT will be logged in binlog, and we have to
+         replicate it to make all nodes have consistent event definitions
+         Wsrep DDL replication is triggered inside Events::drop_event(),
+         and here we need to prepare the THD so that DDL replication is
+         possible, essentially it requires setting sql_command to
+         SQLCOMM_DROP_EVENT, we will switch sql_command for the duration
+         of DDL replication only.
+      */
+      const enum_sql_command sql_command_save= thd->lex->sql_command;
+      const bool sql_command_set= WSREP(thd);
+
+      if (sql_command_set)
         thd->lex->sql_command = SQLCOM_DROP_EVENT;
-        WSREP_TO_ISOLATION_BEGIN(WSREP_MYSQL_DB, NULL, NULL);
-      }
 
       ret= Events::drop_event(thd, dbname, name, FALSE);
 
-      WSREP_TO_ISOLATION_END;
+      if (sql_command_set)
+      {
+        WSREP_TO_ISOLATION_END;
+        thd->lex->sql_command = sql_command_save;
+      }
 
-#ifdef WITH_WSREP
-  error:
-#endif
       thd->tx_read_only= save_tx_read_only;
       thd->security_ctx->master_access= saved_master_access;
     }

programming_language: C++