CVE-2023-48946

What it actually does

The box_mpy function in Virtuoso 7.2.11 contains an unhandled condition that allows a remote SELECT statement to trigger a crash or resource exhaustion, resulting in denial of service.

Why it matters to the business

Public or internal database services become unavailable, interrupting dependent applications and analytics workloads until the process is restarted.

How an attack unfolds

An unauthenticated attacker connects to a Virtuoso instance over the network and issues a specially crafted SELECT query that reaches the vulnerable box_mpy code path, causing the server to terminate or hang.

How to fix it

Upgrade to the latest available Virtuoso build once a fix is released; in the interim restrict network access to the SQL port, disable unnecessary query interfaces, and monitor for abnormal query patterns.

How to confirm the fix worked

Confirm the running version is 7.2.11 or earlier, attempt the known triggering SELECT in a test environment, and verify that the server no longer crashes after applying any available patch.

Typical attack path

1. Locate publicly reachable Virtuoso instances via network scanning or known endpoints
2. Establish a connection and authenticate if required
3. Submit a crafted SELECT statement designed to exercise the box_mpy flaw
4. Observe server crash or sustained resource consumption confirming denial of service

How to detect it

Review Virtuoso server logs for repeated crashes or out-of-memory events immediately following SELECT statements, and correlate with network connections to the SQL listener port.

• box_mpy
• Virtuoso server process termination after SELECT
• sudden high CPU or memory usage on virtuoso-t process

What your security team should do

• Block or rate-limit unauthenticated access to Virtuoso SQL ports from untrusted networks
• Deploy web application or database firewalls capable of inspecting and blocking suspicious SELECT patterns
• Schedule immediate upgrade once a patched release is published
• Add Virtuoso process monitoring and automatic restart procedures to limit downtime