MariaDB SQL User to OS Command Execution via Chained Memory Bugs

The report shows how two memory-safety flaws in MariaDB can be chained by an ordinary database user to execute OS commands as the mariadbd process through a single TCP SQL session.

The first bug in SYS_REFCURSOR creates a use-after-free condition during FETCH, enabling control of a virtual call. The second, in ST_Area, provides an out-of-bounds read via a crafted MULTIPOLYGON, leaking heap and mariadbd base addresses despite ASLR and PIE.

The chain modifies the session’s Security_context::master_access to grant FILE, enabling UDF-based command execution. If the plugin directory is not writable, an alternative call chain reaches execlp("/bin/sh", ...). The PoC worked against mariadb:13.0.1-rc with ASLR, PIE, and Full RELRO enabled in roughly half of attempts.

Report: https://hackerone.com/reports/3856148