CVE-2024-20994

What it actually does

The flaw in the Information Schema component allows a low-privileged network attacker to trigger a hang or repeatable crash resulting in complete denial of service against the MySQL Server.

Why it matters to the business

Database services may experience unplanned downtime, interrupting dependent applications and business operations until manual restart or failover occurs.

How an attack unfolds

An attacker with network access and a low-privileged account connects via supported protocols, issues crafted queries against the Information Schema, and leverages the difficult-to-exploit condition to induce repeated server crashes or hangs.

How to fix it

Upgrade MySQL Server to releases after 8.0.36 and after 8.3.0. Restrict network access to trusted sources and limit privileges of database accounts.

How to confirm the fix worked

Confirm the installed MySQL version exceeds the affected releases, review release notes for the fix, and perform load testing with Information Schema queries to verify stability.

Typical attack path

1. Obtain network connectivity to the MySQL Server
2. Authenticate using a low-privileged account
3. Send specially crafted queries targeting the Information Schema component
4. Cause the server to hang or crash repeatedly

How to detect it

Examine MySQL error and crash logs for repeated hangs or terminations involving the Information Schema component and correlate with unusual authenticated sessions from low-privileged accounts.

What your security team should do

• Apply the latest MySQL patches as soon as they are available
• Enforce least-privilege database accounts and network segmentation
• Monitor database logs for repeated crashes tied to Information Schema activity