CVE-2020-7221
mariadb: mysql_install_db allows privilege escalation due to unsafe chown and chmod operations
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · February 4, 2020
Updated · November 22, 2025
Description
A privilege escalation vulnerability was found in MariaDB, in the way it handled a setuid program during the installation process. A local MySQL user could abuse this flaw to escalate their privileges on the system, by gaining root privileges once the bash script mysql_install_db.sh is executed.
Statement
This flaw did not affect the versions of MariaDB as shipped with Red Hat Enterprise Linux 7, and 8 as they did not include the vulnerable code, which was introduced in a newer version of the package. The same is true for the versions of MariaDB as shipped with Red Hat Software Collections 3.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-267 · Privilege Defined With Unsafe Actions