CVE-2021-47491

What it actually does

The vulnerability permits transparent huge page (THP) collapse for non-regular files such as block devices when opened read-only and mapped with execute permission, contrary to the intended restriction to regular files only.

Why it matters to the business

May lead to unexpected system bugs or crashes on Ubuntu systems running MySQL 8.0, increasing operational risk and potential downtime across widely deployed database environments.

How an attack unfolds

An attacker identifies a non-regular file, opens it read-only, maps it with VM_EXEC permission to trigger khugepaged collapse of THP, resulting in bugs that threat actors associated with Android Kernel Remote Code Execution Vulnerability may leverage.

How to fix it

Upgrade affected MySQL packages to fixed versions including mysql-8.0 (Ubuntu:20.04:LTS) 8.0.35-0ubuntu0.20.04.1 and mysql-8.0 (Ubuntu:22.04:LTS) 8.0.35-0ubuntu0.22.04.1.

How to confirm the fix worked

Confirm installed MySQL package versions match or exceed the listed fixed releases and verify presence of the khugepaged vm_file check patch in the running kernel.

Typical attack path

1. Locate non-regular file such as block device
2. Open file read-only and map with execute permission
3. Trigger khugepaged THP collapse
4. Exploit resulting kernel bug for denial of service or further impact

How to detect it

Review kernel logs for THP collapse events involving non-regular files, khugepaged warnings, and any related process activity tied to the listed threat actors.

What your security team should do

• Apply the listed MySQL package updates on all affected Ubuntu systems without delay
• Audit workloads for use of THP on non-regular files
• Monitor EPSS and threat actor activity for any increase in exploitation attempts