CVE-2024-20964

What it actually does

Flaw in MySQL Server Security: Privileges component permits a low-privileged network attacker to trigger a hang or repeatable crash (complete denial of service) despite the authorization bypass requiring high attack complexity.

Why it matters to the business

Successful exploitation produces database outages that interrupt applications, analytics, and services relying on the affected MySQL instances; low exploit likelihood and absence from KEV reduce immediate operational urgency.

How an attack unfolds

An attacker with a low-privileged account obtains network access to the MySQL server and crafts specific protocol requests that abuse the privilege-handling logic; because the vulnerability is difficult to exploit, success depends on precise timing and knowledge of internal state, ultimately forcing the server process into a hang or crash without requiring further authentication escalation.

How to fix it

Upgrade all MySQL 8.0.x installations to a version newer than 8.0.35 and all 8.2.x installations to a version newer than 8.2.0; apply Oracle Critical Patch Updates as they become available and verify the fix version in the server banner after deployment.

How to confirm the fix worked

After patching, confirm the running server reports a fixed version string; re-test with the original low-privileged account to verify that the crafted requests no longer produce a crash or hang; monitor Oracle release notes for explicit mention of CVE-2024-20964 resolution.

Typical attack path

1. Obtain low-privileged network credentials for the MySQL instance
2. Establish a connection using one of the supported protocols
3. Send crafted requests that trigger the privilege-handling flaw
4. Cause repeated crashes or a hang, resulting in denial of service

How to detect it

Search database error logs and audit logs for repeated connection attempts from low-privileged accounts that coincide with abrupt server restarts or crash dumps; correlate with network flow data showing unusual protocol traffic volumes from authenticated clients.

What your security team should do

• Prioritize patching internet-facing or multi-tenant MySQL deployments within standard change windows
• Review and tighten network access controls to limit unnecessary protocol exposure
• Audit existing low-privileged accounts and revoke unnecessary network privileges
• Incorporate the fixed version numbers into automated vulnerability scanning policies