CVE-2024-21087

What it actually does

Vulnerability in the MySQL Server Group Replication Plugin allows a high-privileged attacker with network access to trigger a hang or repeatable crash, resulting in complete denial of service.

Why it matters to the business

Database services become unavailable, causing operational downtime and potential disruption to dependent applications; low exploitation likelihood reduces urgency but still requires patching within standard maintenance windows.

How an attack unfolds

An attacker with high database privileges and network connectivity crafts malicious requests over supported protocols targeting the Group Replication component, leading to server instability and repeated crashes without requiring user interaction.

How to fix it

Upgrade affected MySQL installations to versions beyond 8.0.36 and 8.3.0; apply the following package updates where applicable: opensc (Debian:12) fixed in 0.22.0-1, opensc (Debian:13) fixed in 0.22.0-1, opensc/opensc (GIT) fixed in 1252aca9.

How to confirm the fix worked

Verify MySQL server versions are newer than the affected releases, confirm Group Replication Plugin stability under load, and review release notes for the specific fix.

Typical attack path

1. Obtain high-privileged MySQL account
2. Establish network connectivity to the server
3. Send specially crafted protocol messages to the Group Replication Plugin
4. Induce hang or crash to achieve denial of service

How to detect it

Review MySQL error logs and group replication logs for repeated crash or hang events originating from network connections; correlate with high-privileged account activity.

What your security team should do

• Prioritize patching during next maintenance cycle given the low EPSS and absence from KEV
• Restrict high-privileged network access to MySQL instances using firewalls and authentication controls
• Monitor for unusual replication plugin errors in logs
• Test upgrades in staging environments before production deployment