CVE-2024-21159

What it actually does

Allows a high-privileged network attacker to trigger a hang or repeatable crash in the InnoDB storage engine of MySQL Server, resulting in complete loss of availability.

Why it matters to the business

Database services become unavailable, halting dependent applications and causing operational downtime until the server is restarted.

How an attack unfolds

An attacker who already possesses high-privileged database credentials connects to MySQL over any supported protocol and sends specially crafted requests that exercise a flaw in InnoDB, forcing the server process to hang or terminate.

How to fix it

Upgrade affected MySQL Server installations to the latest patched release that resolves the InnoDB denial-of-service condition. Apply vendor updates promptly and verify the new version in staging before production deployment. Restrict network access to the database and enforce least-privilege accounts where possible.

How to confirm the fix worked

Confirm the installed MySQL version is newer than the affected releases, review release notes for the specific fix, and perform controlled load testing with privileged connections to verify the server no longer crashes under the previously triggering conditions.

Typical attack path

1. Obtain high-privileged MySQL credentials through prior compromise or insider access
2. Establish a network connection to the MySQL server using a supported protocol
3. Transmit crafted SQL statements or protocol packets targeting the InnoDB component
4. Induce a hang or crash that terminates or stalls the MySQL process

How to detect it

Monitor MySQL error logs and operating-system process logs for repeated InnoDB-related crashes or abrupt terminations. Correlate timestamps of crashes with connections from high-privileged accounts. Review network flow data for unusual volumes of traffic from authorized database clients immediately preceding outages.

What your security team should do

• Apply the vendor-supplied patch to all MySQL 8.0 and 8.3 instances without delay
• Audit and reduce the number of high-privileged database accounts with network access
• Enable connection and query logging to detect anomalous privileged activity
• Test failover and restart procedures to minimize recovery time after any future DoS event