CVE-2024-20970

What it actually does

The flaw in the MySQL Server Optimizer component permits a high-privileged network attacker to submit crafted input that triggers a hang or repeatable crash, resulting in complete denial of service for the database process.

Why it matters to the business

Database-dependent applications and services may suffer unplanned downtime or unavailability, leading to operational disruption and potential data access loss until the server is restarted.

How an attack unfolds

An attacker who already possesses high-privileged credentials connects to an affected MySQL instance over the network and issues specially constructed queries that exercise the vulnerable optimizer code path, causing the server to hang or crash.

How to fix it

Upgrade MySQL Server to a version newer than 8.0.35 and 8.2.0 that contains the fix for the Optimizer component; apply vendor-supplied patches as soon as they become available and restart affected instances.

How to confirm the fix worked

Confirm the installed MySQL version is no longer in the affected range, review release notes for the Optimizer fix, and perform controlled load testing with optimizer-heavy workloads to verify stability.

Typical attack path

1. Obtain high-privileged MySQL credentials
2. Establish a network connection using supported protocols
3. Issue malicious queries that reach the Optimizer component
4. Trigger repeated crash or hang to achieve denial of service

How to detect it

Review MySQL error logs and crash reports for repeated optimizer-related failures, correlate privileged account login events with subsequent server instability, and inspect network traffic for unusual query patterns from administrative users.

What your security team should do

• Prioritize patching MySQL Server instances to a fixed release
• Limit network exposure of database ports and enforce least-privilege access for high-privileged accounts
• Enable enhanced logging of optimizer queries and monitor for abnormal crash patterns