Cloudanix VulnDB

CVE-2024-21102

Medium · 4.9

CVSS

4.9

EPSS

1.1%

Published

Apr 16, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A problem in the database server lets certain trusted users with network access crash or freeze the system, interrupting normal operations until it is restarted.

Exploitation
Remote Authenticated
Attacker needs
High Privilege
Complexity
Low
Impact
Denial Of Service
Component
Network Service
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw in the Thread Pooling component allows a high-privileged network attacker to trigger a hang or repeatable crash, resulting in complete denial of service for the MySQL Server process.

Why it matters to the business

Successful exploitation can interrupt database availability, causing operational downtime for applications that depend on the server and requiring administrative intervention to restore service.

How an attack unfolds

An attacker with high privileges connects to the MySQL Server over supported protocols and sends specially crafted requests that abuse the Thread Pooling component, exhausting resources or forcing the server into a hung or crashed state.

How to fix it

Upgrade affected MySQL Server installations to the latest patched release that resolves the thread pooling issue; apply vendor security updates promptly and restrict network access to privileged accounts where possible.

How to confirm the fix worked

Verify the installed MySQL Server version against the list of affected releases (8.0.36 and earlier, 8.3.0 and earlier); after patching, confirm the server remains stable under expected privileged workloads and review release notes for the specific fix.

Typical attack path

  1. Obtain high-privileged network credentials for the MySQL Server
  2. Establish a connection using one of the multiple supported protocols
  3. Transmit crafted traffic targeting the Thread Pooling component
  4. Trigger resource exhaustion or crash to achieve denial of service

How to detect it

Examine MySQL error logs and system crash dumps for repeated server hangs or abrupt terminations originating from the thread pool component; correlate with network connection logs showing activity from privileged accounts around the time of the outage.

What your security team should do

  • Prioritize patching MySQL Server instances to the latest fixed versions given the public disclosure and availability of the advisory
  • Review and enforce least-privilege access for database accounts with network connectivity
  • Monitor database availability metrics and enable logging for thread pool activity to detect anomalous behavior

The record

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Affected packages

Ecosystem Package Introduced Fixed
Chainguard mysql-8.0 0 8.0.38-r0
Chainguard mysql-8.0-bitnami-compat 0 8.0.38-r0
Chainguard mysql-8.0-client 0 8.0.38-r0
Chainguard mysql-8.0-dev 0 8.0.38-r0
Chainguard mysql-8.0-iamguarded-compat 0 8.0.38-r0
Chainguard mysql-8.0-oci-entrypoint 0 8.0.38-r0
Chainguard mysql-8.0-oci-entrypoint-compat 0 8.0.38-r0
Chainguard percona-server-8.3 0 8.3.0-r1
Chainguard percona-server-8.3-dev 0 8.3.0-r1
Chainguard percona-server-8.3-oci-entrypoint 0 8.3.0-r1
Chainguard percona-server-8.3-oci-entrypoint-compat 0 8.3.0-r1
Ubuntu:14.04:LTS mysql-5.5 0 No fix
Ubuntu:16.04:LTS percona-server-5.6 0 No fix
Ubuntu:16.04:LTS percona-xtradb-cluster-5.6 0 No fix
Ubuntu:20.04:LTS mariadb-10.3 0 No fix
Ubuntu:20.04:LTS mysql-8.0 0 8.0.37-0ubuntu0.20.04.3
Ubuntu:22.04:LTS mysql-8.0 0 8.0.37-0ubuntu0.22.04.3
Ubuntu:23.10 mysql-8.0 0 8.0.37-0ubuntu0.23.10.2
Ubuntu:24.04:LTS mysql-8.0 0 8.0.37-0ubuntu0.24.04.1
Ubuntu:24.10 mysql-8.0 0 8.0.37-1
Ubuntu:Pro:14.04:LTS mysql-5.5 0 No fix
Ubuntu:Pro:16.04:LTS mysql-5.7 0 No fix
Ubuntu:Pro:16.04:LTS percona-server-5.6 0 No fix
Ubuntu:Pro:16.04:LTS percona-xtradb-cluster-5.6 0 No fix
Ubuntu:Pro:18.04:LTS mysql-5.7 0 No fix
Wolfi percona-server-8.3 0 8.3.0-r1
Wolfi percona-server-8.3-dev 0 8.3.0-r1
Wolfi percona-server-8.3-oci-entrypoint 0 8.3.0-r1
Wolfi percona-server-8.3-oci-entrypoint-compat 0 8.3.0-r1

Related vulnerabilities