MariaDB Low-Privilege User Can Exhaust Memory Through a Formatting Function and Crash the Service

How it was found

Product

Product name: MariaDB Server

Product link: https://github.com/MariaDB/server

Affected versions: Reproduced in a locally built test environment based on the official MariaDB source code, running 13.1.0-MariaDB. SFORMAT() has been available since MariaDB 10.7. The final affected version range should be confirmed by the vendor.

Summary

MariaDB's built-in SFORMAT() function supports string formatting. A low-privilege database user can pass an extremely large width parameter, causing the server to attempt to allocate very large memory before generating the return value.

The attacker does not need administrative privileges. The attacker only needs a database account that can log in and execute an ordinary SELECT. Multiple concurrent requests can cause mariadbd to be terminated by the system OOM mechanism, making the database service unavailable.

The current evidence only proves denial-of-service risk. It does not prove information disclosure, privilege escalation, or remote code execution.

Details

SFORMAT() generates a result according to a format string. For example:

SELECT SFORMAT('{:10}', 'x');

Normally, this formats x using the specified width.

The issue is that the function allows users to specify a very large width, for example:

SELECT LENGTH(SFORMAT('{:2147483647}', 'x'));

Even when the call is wrapped in LENGTH(), the server still needs to generate the full formatted string before calculating its length. Therefore, before the result is returned to the client, mariadbd already attempts to allocate close to 2 GB of memory.

MariaDB has a parsing limit for larger numbers. For example, a width greater than 2147483647 returns an error. However, 2147483647 itself is still accepted and is already enough to cause severe memory consumption. Network result-size limits such as max_allowed_packet do not prevent this because the memory allocation occurs before the result-size check.

Preconditions

Exploitation requires the following conditions:

• The attacker has a low-privilege MariaDB account that can log in over TCP.
• The account can execute ordinary SELECT.
• The target version provides the SFORMAT() function.
• The database process does not have enough available memory to withstand multiple oversized formatting requests.

No table privilege, file privilege, administrator privilege, or user interaction is required.

PoC

Reproduction materials are in the poc/ directory:

• poc/README.md
• poc/Dockerfile.mariadb-source
• poc/build-local-image.sh
• poc/run-local-target.sh
• poc/run-poc.sh
• poc/record-poc-demo.sh
• poc/poc.mp4

The reproduction environment uses a locally source-built image:

mariadb-source-sformat:13.1-preview

Run:

cd poc
chmod +x *.sh
./build-local-image.sh
./run-local-target.sh
./run-poc.sh

The PoC starts a temporary MariaDB container with a memory limit, creates a low-privilege account with only USAGE, and then executes SFORMAT() through an authenticated TCP connection.

The key trigger statement is:

SELECT LENGTH(SFORMAT('{:2147483647}', 'x'));

The PoC sends multiple concurrent requests with the statement above. When the vulnerability exists, expected output includes:

AUTHENTICATED_LOW_PRIVILEGE_TCP=ok
SFORMAT_LOW_PRIVILEGE=ok
SERVER_AFTER_STRESS=down
RESULT: VULNERABLE_CONFIRMED

poc/poc.mp4 is an end-to-end screen recording. It shows local source-image checks, low-privilege TCP authentication, concurrent service crash triggering, container recovery, and date -R time information at the end of the recording.

Score

CVSS 3.1 score: 6.5, Medium.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVSS 3.1 scoring rationale:

• AV:N: The attacker sends SQL through a network database connection.
• AC:L: Exploitation is fixed and does not require a race condition, memory layout control, or special timing.
• PR:L: A low-privilege database account that can execute ordinary SQL expressions is required.
• UI:N: No user interaction is required.
• S:U: The impact is limited to the attacked MariaDB service process.
• C:N / I:N: The current evidence does not prove data disclosure or data tampering.
• A:H: Concurrent oversized formatting requests can cause mariadbd to be terminated by the OOM mechanism, making the database service unavailable.

CWE: CWE-789 (Memory Allocation with Excessive Size Value)

Credit

This vulnerability was discovered by:

• XlabAI Team of Tencent Xuanwu Lab ([email protected])
• Atuin Automated Vulnerability Discovery Engine
• Guannan Wang ([email protected]), Zhanpeng Liu ([email protected]), Jiashuo Liang ([email protected]), Guancheng Li ([email protected])

CVE and credits are preferred.

If you have any questions regarding the vulnerability details, please feel free to reach out to us for further discussion. Our email address is [email protected].

Note

Note that we follow the security industry standard disclosure policy—the 90+30 policy (reference: https://googleprojectzero.blogspot.com/p/vulnerability-disclosure-policy.html). If the aforementioned vulnerabilities cannot be fixed within 90 days of submission, we reserve the right to publicly disclose all information about the issues after this timeframe.

Impact

An attacker with a low-privilege database account can use ordinary SQL requests to exhaust server-side memory, causing the database process to crash or be terminated by the system.

Impact boundaries:

• The issue can interrupt the database service.
• It does not require access to any business table.
• It does not require administrator privileges.
• The current evidence does not prove sensitive data disclosure.
• The current evidence does not prove remote code execution.