CVE-2024-21047

What it actually does

The vulnerability in the InnoDB component allows a high-privileged network attacker to trigger a hang or crash in the MySQL Server, resulting in a complete denial of service.

Why it matters to the business

Successful exploitation leads to database server downtime, disrupting applications and services reliant on the MySQL database, potentially causing operational interruptions and data unavailability.

How an attack unfolds

An attacker with high-privileged network access connects to the MySQL Server using multiple protocols and sends specially crafted requests that exploit a flaw in InnoDB, causing the server to hang or crash repeatedly.

How to fix it

Apply the latest security patches released by Oracle for MySQL Server versions 8.0 and 8.3 to address the vulnerability in InnoDB.

How to confirm the fix worked

Verify the MySQL Server version is updated beyond the affected releases and monitor for any remaining crash incidents in server logs.

Typical attack path

1. Gain high-privileged access to the MySQL Server
2. Establish network connection via supported protocols
3. Transmit malicious packets targeting the InnoDB component
4. Trigger repeated crashes or hangs leading to denial of service

How to detect it

Examine MySQL error logs for repeated InnoDB assertion failures or crashes, and review connection logs for high-privileged access from unexpected sources around the time of incidents.

• InnoDB assertion failure
• mysqld got signal
• mysqld process crash

What your security team should do

• Prioritize patching MySQL Server instances to the latest fixed versions
• Restrict network access to MySQL ports to trusted sources only
• Implement monitoring for unusual database crashes or hangs
• Review and limit high-privileged accounts with network access