• Jon Olav Hauglid's avatar
    Bug#24388746: PRIVILEGE ESCALATION AND RACE CONDITION USING CREATE TABLE · 033b1191
    Jon Olav Hauglid authored
    During REPAIR TABLE of a MyISAM table, a temporary data file (.TMD)
    is created. When repair finishes, this file is renamed to the original
    .MYD file. The problem was that during this rename, we copied the
    stats from the old file to the new file with chmod/chown. If a user
    managed to replace the temporary file before chmod/chown was executed,
    it was possible to get an arbitrary file with the privileges of the
    mysql user.
    
    This patch fixes the problem by not copying stats from the old
    file to the new file. This is not needed as the new file was
    created with the correct stats. This fix only changes server
    behavior - external utilities such as myisamchk still does
    chmod/chown.
    
    No test case provided since the problem involves synchronization
    with file system operations.
    033b1191
ha_myisam.cc 71.7 KB