CVE-2024-21061

What it actually does

The flaw in the MySQL Server Audit Plug-in component permits a high-privileged network attacker to trigger a hang or repeatable crash, resulting in complete denial of service for the database instance.

Why it matters to the business

Successful exploitation produces unplanned database downtime that can interrupt dependent applications and business processes until the server is restarted.

How an attack unfolds

An attacker with high privileges connects over supported network protocols and issues requests that exercise the vulnerable audit plug-in code path, causing the MySQL process to hang or terminate.

How to fix it

Upgrade MySQL Server to a version newer than 8.0.35 and 8.2.0 that contains the fix for the audit plug-in component; apply vendor patches as they become available and test in a staging environment before production deployment.

How to confirm the fix worked

Verify the running MySQL version is no longer listed as affected, review release notes for the audit plug-in fix, and confirm the server remains stable under equivalent privileged network load.

Typical attack path

1. Obtain high-privileged network credentials for the MySQL instance
2. Establish a connection using any supported protocol
3. Send crafted requests that invoke the audit plug-in
4. Trigger repeated crashes or hangs to sustain denial of service

How to detect it

Examine MySQL error logs and audit plug-in logs for repeated crash or hang entries around the time of suspected incidents; correlate with privileged connection records from the network.

What your security team should do

• Prioritize patching affected MySQL instances to the latest fixed release
• Restrict network access to the database to only trusted administrative hosts
• Monitor database availability metrics for sudden crashes or hangs
• Review and tighten high-privileged account usage and network exposure