CVE-2024-21173

What it actually does

The flaw in the InnoDB component permits a high-privileged network attacker to trigger a hang or repeatable crash, resulting in complete denial of service for the MySQL Server process.

Why it matters to the business

Successful exploitation leads to unplanned database downtime that can interrupt dependent applications and services, increasing operational costs and affecting availability for organizations using affected MySQL versions.

How an attack unfolds

An attacker who already possesses high-privileged network credentials connects to the MySQL Server over supported protocols and sends specially crafted traffic that triggers the InnoDB vulnerability, causing the server to hang or crash.

How to fix it

Upgrade affected MySQL Server installations to versions newer than 8.0.37 and 8.4.0. When MySQL is used through bigbluebutton/bigbluebutton, apply the fix present in commit 04e916798b6b1f53f88513df3168f009b57b8f18.

How to confirm the fix worked

Confirm the running MySQL Server version is newer than the listed affected releases and test that the server remains stable under the same privileged network operations that previously triggered the crash.

Typical attack path

1. Obtain high-privileged network credentials for the MySQL Server
2. Establish a connection using one of the supported network protocols
3. Transmit crafted requests that exercise the vulnerable InnoDB code path
4. Cause the server process to hang or terminate

How to detect it

Review database server logs for unexpected crashes or hangs, correlate with privileged connection events, and examine network traffic to the MySQL ports from administrative accounts around the time of any availability incidents.

What your security team should do

• Prioritize patching MySQL Server instances to the fixed releases as soon as possible
• Restrict network access to MySQL ports to only trusted administrative hosts
• Review privilege assignments to ensure only necessary accounts have high-privileged network access
• Monitor for availability alerts on MySQL services