Vulnerability

Affected software: MySQL Governor versions below 1.2-46

MySQL Governor keeps semaphores in /dev/shm/ directory which is accessible from within CageFS. User can execute mkdir /dev/shm/sem.governor_bad_users_list_sem in a loop and wait for MySQL Governor to restart e.g. during update. If user wins a race, then directory is created and MySQL Governor can no longer be started due to segment violation error.

Exploit

$ while true; do mkdir /dev/shm/sem.governor_bad_users_list_sem; done

Solution

Update MySQL Governor to version 1.2-46 or later.

Timeline

• 2019-07-16 - Vulnerability reported to vendor.
• 2019-07-16 - Response from vendor.
• 2019-08-01 - Beta version 1.2-46 of MySQL Governor released with MYSQLG-410 vulnerability fixed.
• 2019-08-19 - Production version 1.2-46 of MySQL Governor released with MYSQLG-410 vulnerability fixed.