CVE-2010-3835 in MySQL
Summary
by MITRE
MySQL 5.1 before 5.1.51 and 5.5 before 5.5.6 allows remote authenticated users to cause a denial of service (mysqld server crash) by performing a user-variable assignment in a logical expression that is calculated and stored in a temporary table for GROUP BY, then causing the expression value to be used after the table is created, which causes the expression to be re-evaluated instead of accessing its value from the table.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/12/2021
This vulnerability affects MySQL database versions prior to 5.1.51 and 5.5.6, representing a critical denial of service flaw that can be exploited by authenticated remote attackers. The vulnerability stems from improper handling of user variables within logical expressions during query execution, specifically when these expressions are stored in temporary tables for GROUP BY operations. The flaw manifests when a user variable assignment occurs within a logical expression that gets calculated and stored in a temporary table structure, creating a scenario where subsequent access to the stored value triggers unexpected re-evaluation behavior rather than retrieving the pre-calculated result from the table.
The technical implementation of this vulnerability involves the MySQL query optimizer's handling of user variables in complex expressions. When a query contains a user variable assignment within a logical expression that is part of a GROUP BY clause, the database engine creates a temporary table to store intermediate results. However, the internal state management fails to properly track variable assignments within these temporary structures, leading to a condition where the expression gets re-evaluated rather than accessing the stored value. This re-evaluation process can cause memory corruption or invalid state conditions that ultimately result in the mysqld server process crashing and becoming unavailable to legitimate users.
The operational impact of this vulnerability extends beyond simple service disruption, as it can be leveraged by malicious actors to systematically destabilize database servers without requiring elevated privileges. Attackers need only authenticate to the MySQL server with valid credentials to exploit this flaw, making it particularly dangerous in environments where database access is widely distributed. The vulnerability affects both MySQL 5.1 and 5.5 series, indicating a fundamental issue in the query execution engine that persisted across multiple major releases, suggesting a complex interaction between variable scoping, temporary table management, and expression evaluation logic. This flaw can be classified under CWE-121 as a buffer overflow condition or CWE-248 as an improper exception handling scenario, depending on the specific execution path taken during exploitation.
Mitigation strategies should focus on immediate patching of affected MySQL installations to versions 5.1.51 or 5.5.6 and later, which contain the necessary fixes to properly handle user variable assignments within temporary table contexts. Organizations should also implement monitoring solutions to detect unusual patterns of query execution that might indicate exploitation attempts, particularly around GROUP BY operations involving user variables. Database administrators should consider implementing connection throttling and query execution limits to reduce the impact of potential attacks, while also reviewing user permissions to minimize the attack surface. The vulnerability aligns with ATT&CK technique T1499.004 for network denial of service and T1566.001 for valid accounts as it leverages legitimate database access to cause service disruption without requiring additional privileges or system-level access. Organizations should also consider implementing database activity monitoring to detect and alert on potentially malicious query patterns that could trigger this vulnerability.