CVE-2024-21129

What it actually does

High-privileged network attacker can trigger a hang or repeatable crash in the MySQL Server DDL component, resulting in complete denial of service with no data disclosure or modification.

Why it matters to the business

Database downtime that interrupts applications and services relying on the affected MySQL instances, with low urgency given the requirement for high privileges and absence of known exploitation in the wild.

How an attack unfolds

An authenticated high-privileged user with network access crafts and sends malicious DDL statements over supported protocols to the Server DDL component, causing the MySQL process to hang or crash repeatedly.

How to fix it

Upgrade MySQL Server to a version later than 8.0.37 for the 8.0 branch and later than 8.4.0 for the 8.4 branch; apply Oracle's latest security patches as they become available and restrict unnecessary high-privileged network access.

How to confirm the fix worked

Verify server version is newer than the affected releases, review Oracle release notes for the fix, and confirm that high-privileged DDL operations no longer cause crashes under expected load.

Typical attack path

1. Obtain high-privileged network credentials for the MySQL Server
2. Establish a connection via one of the supported protocols
3. Submit crafted DDL commands targeting the vulnerable Server DDL component
4. Observe repeated server hang or crash resulting in denial of service

How to detect it

Review MySQL error logs and process crash dumps for repeated DDL-related failures or abrupt terminations; correlate with authentication events from high-privileged accounts around the time of incidents.

What your security team should do

• Prioritize patching MySQL instances that allow high-privileged network access
• Limit DDL privileges to only essential administrative accounts
• Monitor for unusual crash or hang events in database logs
• Review and reduce the attack surface of publicly exposed MySQL ports