CVE-2024-21213

What it actually does

High-privileged local attacker with logon access can trigger a hang or repeatable crash (complete DoS) in the InnoDB component after another user performs a required interaction.

Why it matters to the business

Successful exploitation causes unplanned database downtime and service disruption; the vulnerability has been public for over two years with negligible exploit activity and affects downstream Kafka-based processing pipelines that depend on the listed Storm components.

How an attack unfolds

An attacker with administrative logon to the host running the affected MySQL instance waits for or induces a second user to perform an action, then leverages local privileges to trigger the InnoDB flaw resulting in server unavailability; no named threat actors or ransomware campaigns are associated with this issue.

How to fix it

Upgrade org.apache.storm:storm-kafka and org.apache.storm:storm-kafka-client to version 1.2.3 or later; apply the corresponding MySQL Server patches for 8.0.39+, 8.4.2+, and 9.0.1+ once available for the database layer.

How to confirm the fix worked

Verify package versions of storm-kafka and storm-kafka-client are at 1.2.3 or newer; confirm MySQL Server instances are running supported fixed releases and test that the InnoDB component no longer exhibits the described denial-of-service behavior under the documented conditions.

Typical attack path

1. Obtain high-privileged local logon to the MySQL host infrastructure
2. Induce or wait for required human interaction from another user
3. Trigger the InnoDB condition to produce a hang or crash

How to detect it

Review authentication and process execution logs on database hosts for unexpected local administrative sessions coinciding with MySQL crashes or hangs; examine application logs from dependent Storm Kafka consumers for sudden connection losses or restarts.

What your security team should do

• Prioritize upgrade of all listed Storm Kafka packages to 1.2.3 within the next maintenance window
• Review local access controls and privileged accounts on database hosts
• Monitor for any new MySQL InnoDB patches and schedule database upgrades accordingly