Insecure automated optimizations in MariaDB - CVE-2023-52970

Vulnerability identifier: #VU120623

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-52970

CWE-ID: CWE-1038

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to perform a denial of service attack.

The vulnerability exists due to insecure automated optimization when handling inserts from a derived table containing insert target table. A remote privileged user can crash the server with a specially crafted query. 

MariaDB
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing 15
Galera for Ericsson 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Enterprise Storage
Red Hat Enterprise Linux for x86_64
Anolis OS
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Slackware Linux
Server Applications Module
SUSE Package Hub 15
openSUSE Leap
Ubuntu
Fedora
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
Judy-devel
Judy
asio-devel
mariadb
mariadb (Red Hat package)
mariadb-devel
mariadb-backup
mariadb-common
mariadb-embedded
mariadb-embedded-devel
mariadb-errmsg
mariadb-gssapi-server
mariadb-oqgraph-engine
mariadb-pam
mariadb-server
mariadb-server-galera
mariadb-server-utils
mariadb-test
libmariadbd19
mariadb-errormessages
mariadb-rpm-macros
mariadb-bench-debuginfo
mariadb-galera
libmariadbd-devel
mariadb-test-debuginfo
mariadb-tools-debuginfo
mariadb-client
mariadb-debuginfo
mariadb-tools
libmariadbd19-debuginfo
mariadb-bench
mariadb-client-debuginfo
mariadb-debugsource
mariadb-10.6 (Ubuntu package)
mariadb10.11
mariadb (Ubuntu package)
mariadb10.11 (Red Hat package)
galera
galera (Red Hat package)
IBM Cloud Object Storage Systems

Install updates from vendor's website.

MariaDB - addressed in versions 10.5.29, 10.6.22, 10.11.12, 11.4.6, 11.8.2
Judy-devel - update to 1.0.5-18
Judy - update to 1.0.5-18
asio-devel - update to 1.10.8-7
IBM Cloud Object Storage Systems - addressed in versions 3.20.0.43, 3.20.0.69
mariadb - update to 10.5.29
mariadb (Red Hat package) - update to 10.5.29-2.el9_6
mariadb-devel - update to 10.5.29-2.0.1
mariadb - update to 10.5.29-2.0.1
mariadb-backup - update to 10.5.29-2.0.1
mariadb-common - update to 10.5.29-2.0.1
mariadb-embedded - update to 10.5.29-2.0.1
mariadb-embedded-devel - update to 10.5.29-2.0.1
mariadb-errmsg - update to 10.5.29-2.0.1
mariadb-gssapi-server - update to 10.5.29-2.0.1
mariadb-oqgraph-engine - update to 10.5.29-2.0.1
mariadb-pam - update to 10.5.29-2.0.1
mariadb-server - update to 10.5.29-2.0.1
mariadb-server-galera - update to 10.5.29-2.0.1
mariadb-server-utils - update to 10.5.29-2.0.1
mariadb-test - update to 10.5.29-2.0.1
libmariadbd19 - addressed in versions 10.5.29-150300.3.55.1, 10.6.23-150400.3.40.1, 10.11.14-150600.4.14.1
mariadb-errormessages - addressed in versions 10.5.29-150300.3.55.1, 10.6.23-150400.3.40.1, 10.11.14-150600.4.14.1
mariadb-rpm-macros - addressed in versions 10.5.29-150300.3.55.1, 10.6.23-150400.3.40.1, 10.11.14-150600.4.14.1
mariadb-bench-debuginfo - addressed in versions 10.5.29-150300.3.55.1, 10.6.23-150400.3.40.1, 10.11.14-150600.4.14.1
mariadb-galera - addressed in versions 10.5.29-150300.3.55.1, 10.6.23-150400.3.40.1, 10.11.14-150600.4.14.1
libmariadbd-devel - addressed in versions 10.5.29-150300.3.55.1, 10.6.23-150400.3.40.1, 10.11.14-150600.4.14.1
mariadb-test-debuginfo - addressed in versions 10.5.29-150300.3.55.1, 10.6.23-150400.3.40.1, 10.11.14-150600.4.14.1
mariadb-tools-debuginfo - addressed in versions 10.5.29-150300.3.55.1, 10.6.23-150400.3.40.1, 10.11.14-150600.4.14.1
mariadb-client - addressed in versions 10.5.29-150300.3.55.1, 10.6.23-150400.3.40.1, 10.11.14-150600.4.14.1
mariadb-debuginfo - addressed in versions 10.5.29-150300.3.55.1, 10.6.23-150400.3.40.1, 10.11.14-150600.4.14.1
mariadb - addressed in versions 10.5.29-150300.3.55.1, 10.6.23-150400.3.40.1, 10.11.14-150600.4.14.1
mariadb-tools - addressed in versions 10.5.29-150300.3.55.1, 10.6.23-150400.3.40.1, 10.11.14-150600.4.14.1
libmariadbd19-debuginfo - addressed in versions 10.5.29-150300.3.55.1, 10.6.23-150400.3.40.1, 10.11.14-150600.4.14.1
mariadb-bench - addressed in versions 10.5.29-150300.3.55.1, 10.6.23-150400.3.40.1, 10.11.14-150600.4.14.1
mariadb-test - addressed in versions 10.5.29-150300.3.55.1, 10.6.23-150400.3.40.1, 10.11.14-150600.4.14.1
mariadb-client-debuginfo - addressed in versions 10.5.29-150300.3.55.1, 10.6.23-150400.3.40.1, 10.11.14-150600.4.14.1
mariadb-debugsource - addressed in versions 10.5.29-150300.3.55.1, 10.6.23-150400.3.40.1, 10.11.14-150600.4.14.1
mariadb-10.6 (Ubuntu package) - update to 1:10.6.22-0ubuntu0.22.04.1
mariadb10.11 - addressed in versions 10.11.11-1.fc40, 10.11.11-1.fc41
mariadb (Ubuntu package) - addressed in versions 1:10.11.13-0ubuntu0.24.04.1, 1:11.4.7-0ubuntu0.25.04.1
mariadb10.11 (Red Hat package) - update to 10.11.15-1.el10_1
galera - update to 26.4.22-1
galera (Red Hat package) - update to 26.4.22-1.el9_6

• https://jira.mariadb.org/browse/MDEV-32086

• Multiple DoS vulnerabilities in MariaDB Server
• Slackware Linux update for mariadb
• Red Hat Enterprise Linux 8 update for the mariadb:10.5 module
• Red Hat Enterprise Linux 9 update for multiple packages
• SUSE update for mariadb
• SUSE update for mariadb
• Anolis OS update for mariadb:10.5 module
• Ubuntu update for mariadb-10.6
• Fedora 41 update for mariadb10.11
• Fedora 40 update for mariadb10.11
• Red Hat Enterprise Linux 10 update for mariadb10.11
• SUSE update for mariadb
• Red Hat Enterprise Linux 9 update for the mariadb:10.11 module
• Ubuntu update for mariadb
• Multiple vulnerabilities in IBM Cloud Object System