CVE-2024-20968

What it actually does

High-privileged network attacker can trigger a hang or repeatable crash in MySQL Server Options component, resulting in complete denial of service for the database instance.

Why it matters to the business

Database downtime that disrupts applications, reporting, and transactions until the server is restarted; low probability of exploitation reduces immediate urgency but still requires patching to maintain availability SLAs.

How an attack unfolds

Attacker obtains high-privileged database credentials, connects over supported protocols, and supplies specially crafted option values that trigger the flaw, causing the server process to hang or terminate.

How to fix it

Upgrade affected MySQL 8.0.x installations to the latest 8.0 release containing the fix and upgrade 8.1.0 installations to the corresponding patched 8.1 or later release; apply Oracle Critical Patch Updates promptly.

How to confirm the fix worked

Verify running MySQL version is newer than 8.0.34 and 8.1.0; confirm the server remains stable under load after upgrade and review release notes for the specific fix.

Typical attack path

1. Obtain valid high-privileged MySQL account with network access
2. Connect to the server using a supported protocol
3. Send crafted options payload targeting the Server: Options component
4. Trigger repeated crashes or a hang to achieve denial of service

How to detect it

Inspect MySQL error logs and system crash dumps for repeated abrupt terminations or hang indicators around the time of suspicious privileged connections; correlate with authentication logs for unusual high-privileged sessions.

What your security team should do

• Prioritize upgrade of internet-facing or business-critical MySQL instances within standard change windows
• Review and tighten network access controls and privileged account usage for MySQL
• Monitor Oracle CPU advisories for subsequent MySQL releases