CVE-2024-21193

What it actually does

The flaw in the PS component allows a high-privileged network attacker to trigger a hang or repeatable crash, resulting in complete denial of service for the MySQL Server.

Why it matters to the business

Leads to unplanned database downtime that can interrupt dependent applications and services; low exploit likelihood and no ransomware association reduce immediate urgency but still require timely patching given wide MySQL deployment.

How an attack unfolds

An authenticated high-privileged attacker connects over network protocols to an affected MySQL instance and issues crafted requests that exploit the PS component, causing the server process to hang or crash repeatedly.

How to fix it

Upgrade MySQL Server to versions after 8.0.39, 8.4.2, and 9.0.1. For the Jenkins Mesos plugin update to 0.18 or later.

How to confirm the fix worked

Confirm server version exceeds the affected ranges, review release notes for the PS component fix, and perform stability testing under privileged network load.

Typical attack path

1. Obtain high-privileged network credentials for the MySQL server
2. Establish a connection using any supported protocol
3. Transmit specially formed requests targeting the PS component
4. Induce server hang or crash to achieve denial of service

How to detect it

Inspect database error and crash logs for repeated hangs or terminations tied to privileged sessions; correlate with network connection records from administrative accounts.

What your security team should do

• Apply the MySQL version upgrades immediately on internet-facing or high-value instances
• Limit network exposure of database ports to only trusted administrative hosts
• Enable enhanced logging for privileged sessions and monitor for abrupt server restarts
• Validate Jenkins Mesos plugin is at 0.18 or newer where deployed