CVE-2022-32082

MariaDB v10.5 to v10.7 was discovered to contain an assertion failure at table->get_ref_count() == 0 in dict0dict.cc.

MariaDB v10.5 to v10.7 was discovered to contain an assertion failure at table->get_ref_count() == 0 in dict0dict.cc.

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

The following packages have been upgraded to a later upstream version: galera (26.4.14), mariadb (10.5.22).

Security Fix(es):

• mariadb: node crashes with Transport endpoint is not connected mysqld got signal 6 (CVE-2023-5157)
• mariadb: use-after-poison in prepare_inplace_add_virtual in handler0alter.cc (CVE-2022-32081)
• mariadb: assertion failure at table->get_ref_count() == 0 in dict0dict.cc (CVE-2022-32082)
• mariadb: segmentation fault via the component sub_select (CVE-2022-32084)
• mariadb: server crash in st_select_lex_unit::exclude_level (CVE-2022-32089)
• mariadb: server crash in JOIN_CACHE::free or in copy_fields (CVE-2022-32091)
• mariadb: compress_write() fails to release mutex on failure (CVE-2022-38791)
• mariadb: NULL pointer dereference in spider_db_mbase::print_warnings() (CVE-2022-47015)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

The following packages have been upgraded to a later upstream version: galera (26.4.14), mariadb (10.5.22).

Security Fix(es):

• mariadb: node crashes with Transport endpoint is not connected mysqld got signal 6 (CVE-2023-5157)
• mariadb: use-after-poison in prepare_inplace_add_virtual in handler0alter.cc (CVE-2022-32081)
• mariadb: assertion failure at table->get_ref_count() == 0 in dict0dict.cc (CVE-2022-32082)
• mariadb: segmentation fault via the component sub_select (CVE-2022-32084)
• mariadb: server crash in st_select_lex_unit::exclude_level (CVE-2022-32089)
• mariadb: server crash in JOIN_CACHE::free or in copy_fields (CVE-2022-32091)
• mariadb: compress_write() fails to release mutex on failure (CVE-2022-38791)
• mariadb: NULL pointer dereference in spider_db_mbase::print_warnings() (CVE-2022-47015)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

MariaDB v10.5 to v10.7 was discovered to contain an assertion failure at table->get_ref_count() == 0 in dict0dict.cc.

MariaDB v10.5 to v10.7 was discovered to contain an assertion failure at table->get_ref_count() == 0 in dict0dict.cc.

MariaDB v10.5 to v10.7 was discovered to contain an assertion failure at table->get_ref_count() == 0 in dict0dict.cc.

MariaDB v10.5 to v10.7 was discovered to contain an assertion failure at table->get_ref_count() == 0 in dict0dict.cc.

zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches. (CVE-2018-25032) A use-after-poison in prepare_inplace_add_virtual at /storage/innobase/handler/handler0alter.cc. (CVE-2022-32081) An assertion failure at table->get_ref_count() == 0 in dict0dict.cc. (CVE-2022-32082) Segmentation fault via the component sub_select. (CVE-2022-32084) Segmentation fault via the component st_select_lex_unit::exclude_level. (CVE-2022-32089)

These are all security issues fixed in the libmariadbd-devel-10.9.3-1.1 package on the GA media of openSUSE Tumbleweed.

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

The following packages have been upgraded to a later upstream version: galera (26.4.14), mariadb (10.5.22).

Security Fix(es):

• mariadb: node crashes with Transport endpoint is not connected mysqld got signal 6 (CVE-2023-5157)

• mariadb: use-after-poison in prepare_inplace_add_virtual in handler0alter.cc (CVE-2022-32081)

• mariadb: assertion failure at table->get_ref_count() == 0 in dict0dict.cc (CVE-2022-32082)

• mariadb: segmentation fault via the component sub_select (CVE-2022-32084)

• mariadb: server crash in st_select_lex_unit::exclude_level (CVE-2022-32089)

• mariadb: server crash in JOIN_CACHE::free or in copy_fields (CVE-2022-32091)

• mariadb: compress_write() fails to release mutex on failure (CVE-2022-38791)

• mariadb: NULL pointer dereference in spider_db_mbase::print_warnings() (CVE-2022-47015)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for mariadb fixes the following issues:

• Updated to 10.6.9:

  • CVE-2022-32082: Fixed a reachable assertion that would crash the server (bsc#1201162).
  • CVE-2022-32089: Fixed a segmentation fault that coudl be triggered via a crafted query (bsc#1201169).
  • CVE-2022-32081: Fixed a buffer overflow on instant ADD/DROP of generated column (bsc#1201161).
  • CVE-2022-32091: Fixed a memory corruption issue that could be triggered via a crafted query (bsc#1201170).
  • CVE-2022-32084: Fixed a segmentation fault on INSERT SELECT queries (bsc#1201164).

• Additionaly, the following issues were previously fixed:

  • CVE-2022-32088: Fixed a server crash when using ORDER BY with window function and UNION(bsc#1201168).
  • CVE-2022-32087: Fixed a segmentation fault that could be triggered via a crafted query (bsc#1201167).
  • CVE-2022-32086: Fixed a server crash on INSERT SELECT queries (bsc#1201166).
  • CVE-2022-32085: Fixed a segmentation fault that could be triggered via a crafted query (bsc#1201165).
  • CVE-2022-32083: Fixed a segmentation fault that could be triggered via a crafted query (bsc#1201163).

Bugfixes:

• Update mysql-systemd-helper to be aware of custom group (bsc#1200105).

This update for mariadb fixes the following issues:

Update to 10.5.17:

• CVE-2022-32082: Fixed assertion failure at table->get_ref_count() == 0 in dict0dict.cc (bsc#1201162).

• CVE-2022-32089: Fixed segmentation fault via the component st_select_lex_unit::exclude_level (bsc#1201169).

• CVE-2022-32081: Fixed use-after-poison in prepare_inplace_add_virtual at /storage/innobase/handler/handler0alter.cc (bsc#1201161).

• CVE-2022-32091: Fixed use-after-poison in __interceptor_memset at /libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc (bsc#1201170).

• CVE-2022-32084: Fixed segmentation fault via the component sub_select (bsc#1201164).

• CVE-2022-38791: Fixed deadlock in compress_write in extra/mariabackup/ds_compress.cc (bsc#1202863).

• CVE-2022-32088: Fixed segmentation fault via the component Exec_time_tracker::get_loops/Filesort_tracker::report_use/filesort (bsc#1201168).

• CVE-2022-32087: Fixed segmentation fault via the component Item_args::walk_args (bsc#1201167).

• CVE-2022-32086: Fixed segmentation fault via the component Item_field::fix_outer_field (bsc#1201166).

• CVE-2022-32085: Fixed segmentation fault via the component Item_func_in::cleanup/Item::cleanup_processor (bsc#1201165).

• CVE-2022-32083: Fixed segmentation fault via the component Item_subselect::init_expr_cache_tracker (bsc#1201163).

Bugfixes:

• Fixed mysql-systemd-helper being unaware of custom group (bsc#1200105).

Several security issues were discovered in MariaDB and this update includes new upstream MariaDB versions to fix these issues.

MariaDB has been updated to 10.3.37 in Ubuntu 20.04 LTS and to 10.6.11 in Ubuntu 22.04 LTS and Ubuntu 22.10.

In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.