MySQL/MariaDB/Percona Privilege Escalation via REPAIR TABLE Race Condition (CVE-2016-6663/CVE-2016-5616)

Critical Vulnerability Information I. Vulnerability Overview Vulnerability Type: Privilege Escalation / Race Condition Affected Products: MySQL, MariaDB, Percona CVE IDs: CVE-2016-6663 (Oracle), CVE-2016-5616 II. Background Information The vulnerability exists in MySQL, MariaDB, and Percona databases, allowing low-privileged users to escalate privileges and execute arbitrary code. It exploits unsafe operations performed during the execution of the SQL statement. III. Vulnerability Description Users with privileges can create tables in directories they control. By leveraging the statement, attackers can exploit a race condition to execute arbitrary code. Successful exploitation grants attackers access to all databases on the server and may lead to privilege escalation to the root user. IV. Affected Versions MySQL: - ≤ 5.5.52 - < 10.1.18 - < 10.0.28 MariaDB: - < 5.5.52 - < 5.6.32 - < 5.7.14 Percona Server: - < 5.5.51-38.2 - < 5.6.32-78.1 - < 5.7.14-8 Percona XtraDB Cluster: - < 5.6.32-25.17 - < 5.7.14-26.17 - < 5.5.41-37.0 V. Remediation / Vendor Response MariaDB, MySQL, and Percona were notified in advance and have already released patches prior to this advisory. Affected users are strongly advised to upgrade to the latest versions as soon as possible. Temporary mitigation: Disable symbolic link support in the database configuration file. VI. Business Impact Malicious local users can exploit this vulnerability to execute arbitrary code and escalate privileges to the MySQL system user, potentially gaining root access through additional vulnerabilities, thereby achieving full control over the target server. VII. Reference Links Complete information and historical records are available in the links provided at the end of this document.

Goal Reached Thanks to every supporter — we hit 100%!

MySQL/MariaDB/Percona Privilege Escalation via REPAIR TABLE Race Condition (CVE-2016-6663/CVE-2016-5616)