CVE-2020-7221: 
MariaDB Server vulnerability analysis and mitigation

CVE-2020-7221 affects MariaDB versions 10.4.7 through 10.4.11, specifically the mysql_install_db script. The vulnerability allows privilege escalation from the mysql user account to root due to unsafe execution of chown and chmod commands. This vulnerability was discovered on January 14, 2020, and was fixed in MariaDB 10.4.12 released on January 28, 2020. Notably, this vulnerability does not affect Oracle MySQL product, which implements mysql_install_db differently (OSS Security).

The vulnerability exists in the mysql_install_db script where file permissions and ownership are set unsafely. The script performs a sequence of commands as root that includes changing ownership of auth_pam_tool_dir to mysql user with mode 0700, followed by setting the auth_pam_tool binary as setuid-root with mode 04755. These operations are executed unconditionally without checking the current owner and mode of the auth_pam_tool_dir (OSS Security).

If the mysql account is compromised, an attacker can exploit this vulnerability through a symlink attack or by placing an arbitrary binary in auth_pam_tool_dir/auth_pam_tool, which would gain setuid-root privileges when mysql_install_db is run. This allows full root privileges escalation from a mysql user account (OSS Security).

The issue was fixed in MariaDB 10.4.12 by modifying the script to only execute the problematic commands when the --rpm command line parameter is not passed. For Deb/RPM packaging, MariaDB suggests using specific directory modes: root:mysql 0750 for the auth_pam_tool_dir to maintain security while avoiding the dangerous situation of a setuid-root binary residing in a directory owned by an unprivileged user (GitHub Commit).

The vulnerability was initially reported privately to MariaDB's security team on January 14, 2020. The vendor confirmed the issue the same day and requested embargo until the next release. While a technical discussion about the appropriate fix was attempted, it did not lead to a comprehensive solution. The fix was eventually included in MariaDB 10.4.12, released on January 28, 2020, though the reporter was not informed about the publication (OSS Security).