CVE-2024-21196

What it actually does

Low-privileged network attacker can trigger a hang or repeatable crash in the MySQL Server X Plugin component, resulting in complete denial of service.

Why it matters to the business

Database services become unavailable, causing downtime for applications and potential loss of revenue or operational disruption until the server is restarted.

How an attack unfolds

An attacker with valid low-privilege credentials connects to the MySQL X Plugin over the network and sends specially crafted protocol messages that cause the server process to hang or crash.

How to fix it

Upgrade affected MySQL Server installations to versions later than 8.0.39, 8.4.2, or 9.0.1 as provided in Oracle's security updates.

How to confirm the fix worked

Verify the running MySQL version is no longer listed in the affected ranges and confirm the X Plugin does not exhibit crash behavior under expected low-privilege workloads.

Typical attack path

1. Obtain low-privilege network credentials for a MySQL instance
2. Establish a connection using the X protocol
3. Transmit malformed or malicious X Plugin requests
4. Induce server hang or crash resulting in denial of service

How to detect it

Review MySQL error logs for repeated X Plugin crashes or hangs, correlate with authentication events from low-privilege accounts, and inspect network traffic for anomalous X protocol sessions.

• X Plugin crash or hang entries in mysqld error log
• Repeated connection attempts on X protocol port followed by server restart

What your security team should do

• Apply the latest MySQL Server patches immediately to eliminate the denial-of-service condition
• Restrict network access to the X Plugin port to only trusted clients
• Monitor database availability metrics and set alerts for unexpected restarts or hangs