CVE-2016-6662

What it actually does

Local attackers can overwrite the my.cnf configuration file by pointing general_log_file at it, then abuse the malloc_lib directive to load a malicious library and execute arbitrary code as root.

Why it matters to the business

Attackers who already have a shell on the database server can obtain full root control, leading to complete database compromise, data theft or destruction, and potential lateral movement across the infrastructure.

How an attack unfolds

An attacker with a local account on a vulnerable MySQL/MariaDB/Percona host writes a malicious shared library, sets general_log_file to point at my.cnf, triggers a log rotation or restart to load the new configuration, then uses malloc_lib to force the server to load the attacker-controlled library at startup, resulting in root code execution.

How to fix it

Upgrade MariaDB to 5.5.51+, 10.0.27+, or 10.1.17+; MySQL to 5.5.52+, 5.6.33+, or 5.7.15+; Percona Server to 5.5.51-38.1+, 5.6.32-78.0+, or 5.7.14-7+. Apply the patches referenced in the fixed git commits and restart affected services.

How to confirm the fix worked

Confirm the running server version is at or above the fixed releases listed above, verify that general_log_file and malloc_lib directives cannot be abused via configuration checks, and test that a non-root user cannot write to my.cnf through log-file manipulation.

Typical attack path

1. Obtain local shell access on the database host
2. Create a malicious shared object that will be loaded via malloc_lib
3. Modify general_log_file to reference the my.cnf path and trigger log rotation or restart
4. Set malloc_lib to the attacker-controlled library in the newly written configuration
5. Restart the database service to achieve root code execution

How to detect it

Review database error and general logs for unexpected references to my.cnf or malloc_lib; inspect process startup arguments and loaded libraries for anomalies; correlate local user activity with configuration file modifications around service restarts.

• general_log_file.*my.cnf
• malloc_lib=
• libmysqld.so
• unexpected my.cnf writes by non-root processes

What your security team should do

• Immediately upgrade all affected database instances to the fixed versions
• Restrict local shell access to database servers to only necessary administrators
• Monitor configuration files (my.cnf) for unauthorized changes
• Harden database startup scripts to prevent library preloading attacks