CVE-2024-21207

What it actually does

The vulnerability in the InnoDB component allows a high-privileged attacker with network access to trigger a denial of service condition that causes the MySQL Server to hang or experience repeated crashes.

Why it matters to the business

Exploitation can result in database downtime that interrupts applications and services relying on the database, with low urgency due to minimal EPSS score and lack of known exploitation or ransomware use.

How an attack unfolds

An attacker who already possesses high privileges connects to the MySQL Server over the network using supported protocols and triggers the flaw in the InnoDB component to induce a hang or crash.

How to fix it

Upgrade MySQL Server to fixed releases beyond the affected versions (8.0.38, 8.4.1, 9.0.1 and prior). For the listed Maven packages upgrade to version 3.4.4.

How to confirm the fix worked

Confirm server and package versions after upgrade, review release notes for the fix, and perform availability testing under load from privileged accounts.

Typical attack path

1. Obtain high-privileged network credentials for the MySQL Server
2. Establish a connection via multiple protocols
3. Invoke the vulnerable InnoDB code path
4. Induce a hang or repeated crash to achieve denial of service

How to detect it

Inspect MySQL error logs and system logs for repeated crash or hang entries, correlate with privileged network connection attempts, and review audit logs for unusual InnoDB activity from high-privileged accounts.

What your security team should do

• Apply available updates to eliminate the denial-of-service vector
• Restrict high-privileged network access to the database to the minimum necessary hosts
• Monitor database availability metrics and logs for unexpected hangs or crashes
• Review privileged account activity for anomalies