CVE-2024-20984

What it actually does

The flaw in the MySQL Server Firewall component permits a high-privileged network attacker to trigger a hang or repeatable crash, resulting in complete denial of service for the database instance.

Why it matters to the business

Database services can be made unavailable, interrupting dependent applications and causing operational downtime until the server is restarted.

How an attack unfolds

An attacker with high privileges obtains network access to a vulnerable MySQL instance and sends specially crafted requests through supported protocols that abuse the Firewall security logic, forcing the server process to hang or crash.

How to fix it

Apply the latest Oracle MySQL Server patches that address the Firewall component vulnerability; restrict network access and limit high-privileged accounts to the minimum required.

How to confirm the fix worked

Confirm MySQL Server version is newer than 8.0.35 and 8.2.0, review release notes for the Firewall fix, and test that crafted inputs no longer cause crashes under high-privileged accounts.

Typical attack path

1. Obtain high-privileged database credentials
2. Establish network connection to the MySQL instance using supported protocols
3. Submit crafted input targeting the Firewall component
4. Trigger repeated crashes or hangs to sustain denial of service

How to detect it

Review MySQL error logs and crash dumps for repeated server hangs or terminations originating from the Firewall component under high-privileged sessions; correlate with network connection records from privileged accounts.

What your security team should do

• Prioritize patching MySQL Server instances to versions containing the Firewall fix
• Enforce least-privilege access for database accounts and limit network exposure
• Monitor Oracle security advisories for official fixed-version releases