Incorrect Permission Assignment for Critical Resource

How it was found

Dear Team,

Product Affected: https://github.com/MariaDB/server

File: /server/blob/10.3/sql/mysqld.cc#L2761

}
    if (!SetSecurityDescriptorDacl(&sdPipeDescriptor, TRUE, NULL, FALSE))
{

This was purely identified on code review, Never create NULL ACLs.

A mail was sent to [email protected] and MariaDB team is working on this and a fix will be pushed in next version, attached mail headers for your reference.

Impact

An attacker can set it to Everyone (Deny All Access), which would even forbid administrator access and may lead to privilege escalation.