CVE-2024-21219

What it actually does

A flaw in the MySQL Server DML component allows a high-privileged network attacker to trigger repeated hangs or crashes, resulting in complete denial of service.

Why it matters to the business

Successful exploitation can cause unplanned database outages that interrupt application availability and business operations until the server is restarted.

How an attack unfolds

An attacker who already possesses high database privileges and network access sends specially crafted DML statements over supported protocols, triggering the server to hang or crash repeatedly.

How to fix it

Upgrade MySQL Server to versions later than 8.0.39, 8.4.2, and 9.0.1 as appropriate for each release line.

How to confirm the fix worked

Confirm the installed MySQL version is newer than the affected releases and perform functional testing of DML operations under load to verify stability.

Typical attack path

1. Obtain high-privileged database credentials
2. Establish network connectivity to the MySQL Server
3. Craft and transmit malicious DML statements via supported protocols
4. Induce server hang or crash to achieve denial of service

How to detect it

Examine database error logs and crash reports for repeated DML-related failures originating from privileged accounts; correlate with network connection logs for unusual query volumes.

What your security team should do

• Apply the latest MySQL patches without delay
• Limit network exposure of database instances to trusted sources only
• Review and enforce least-privilege access for database accounts