CVE-2024-21160

What it actually does

Allows a high-privileged network attacker to trigger a denial of service by causing InnoDB to hang or crash the MySQL Server.

Why it matters to the business

Leads to database service interruptions and potential data unavailability for applications relying on MySQL, though exploitation requires elevated privileges and the issue has remained low-risk since publication over two years ago.

How an attack unfolds

An attacker with high database privileges connects remotely via supported protocols and sends specially crafted requests targeting the InnoDB component to force a server hang or repeatable crash.

How to fix it

Upgrade affected MySQL Server installations (8.0.36 and prior, 8.3.0 and prior) to the latest patched releases provided by Oracle.

How to confirm the fix worked

Confirm MySQL Server version is updated past the affected releases, then perform stability testing with privileged network connections to verify the denial-of-service condition is resolved.

Typical attack path

1. Obtain high-privileged MySQL account credentials
2. Establish network connection to the MySQL server using supported protocols
3. Send malicious queries or commands that exercise the vulnerable InnoDB code path
4. Trigger server hang or crash resulting in complete denial of service

How to detect it

Inspect MySQL error logs for repeated InnoDB assertion failures, crashes, or abrupt server restarts; correlate with connection logs from privileged accounts during incident windows.

What your security team should do

• Apply the latest MySQL Server patches immediately
• Limit network exposure of MySQL ports to trusted sources only
• Audit and minimize the number of high-privileged database accounts