CVE-2024-21049

What it actually does

The flaw in the MySQL Server DML component permits a high-privileged network attacker to submit specially crafted statements that trigger a hang or repeatable crash, resulting in complete loss of database availability.

Why it matters to the business

Successful exploitation leads to unplanned database downtime that can interrupt dependent applications and services until the server is restarted.

How an attack unfolds

An attacker who already possesses high-privileged network credentials connects to the MySQL instance and issues a malicious DML statement that exploits an unhandled edge case in the server, causing it to hang or crash.

How to fix it

Upgrade mysql/mysql-server to a build that includes commit 057f5c9509c6c9ea3ce3acdc619f3353c09e6ec6 or later; apply the patch and restart affected instances.

How to confirm the fix worked

Confirm the running server reports a version containing the referenced commit, review release notes for the fix, and monitor for absence of the prior crash signature under load testing with DML workloads.

Typical attack path

1. Obtain high-privileged database credentials with network access
2. Establish a connection to the MySQL Server using supported protocols
3. Submit a crafted DML statement that triggers the vulnerability
4. Observe server hang or crash and repeat as needed

How to detect it

Review MySQL error logs and crash reports for repeated abrupt terminations during DML operations; correlate with audit logs showing high-privileged sessions executing unusual statements.

What your security team should do

• Prioritize patching MySQL 8.0.34 and earlier instances within standard change windows
• Restrict high-privileged accounts to trusted networks and enforce strong authentication
• Enable query logging and crash reporting to detect anomalous DML activity
• Test the upgrade in a staging environment before production rollout