CVE-2024-21125

What it actually does

Flaw in the Full-Text Search (FTS) component of MySQL Server allows a high-privileged network attacker to trigger a hang or repeatable crash, resulting in complete denial of service.

Why it matters to the business

Successful exploitation can cause unplanned database downtime, interrupting dependent applications and business operations until the server is restarted.

How an attack unfolds

An attacker with high database privileges connects over the network using supported protocols and crafts input that triggers the FTS vulnerability, forcing the server process to hang or terminate.

How to fix it

Upgrade affected MySQL Server installations (8.0.37 and earlier, 8.4.0 and earlier) to the latest patched releases provided by Oracle.

How to confirm the fix worked

Verify server version after upgrade and confirm the FTS component no longer exhibits the hang or crash behavior under equivalent privileged network access.

Typical attack path

1. Obtain high-privileged database credentials
2. Establish network connection to MySQL Server via supported protocols
3. Issue crafted statements targeting the FTS component
4. Trigger repeated crashes or hangs to sustain denial of service

How to detect it

Review MySQL error logs and process crash dumps for repeated FTS-related terminations or hangs; correlate with network connections from privileged accounts.

What your security team should do

• Apply the latest MySQL Server patches immediately
• Restrict high-privileged accounts to only trusted networks and hosts
• Monitor database availability metrics and error logs for unexpected terminations