CVE-2024-21230

What it actually does

Flaw in the MySQL Server Optimizer component allows a low-privileged network attacker to trigger a hang or repeatable crash, resulting in complete denial of service.

Why it matters to the business

Disrupts database availability for dependent applications and services, potentially causing operational downtime; no ransomware usage or CISA deadline applies.

How an attack unfolds

An attacker with low privileges obtains network access to MySQL via supported protocols and submits crafted requests that abuse the optimizer to induce repeated crashes or hangs; no named threat actors are associated.

How to fix it

Upgrade MySQL Server to versions beyond 8.0.39, 8.4.2, or 9.0.1 as appropriate for the release line; note that listed package fixes reference unrelated ion-java 1.10.5 and do not apply.

How to confirm the fix worked

Confirm MySQL version is updated past the affected releases and test that optimizer-related workloads no longer produce crashes under low-privileged network access.

Typical attack path

1. Obtain low-privileged network credentials for MySQL
2. Connect using any supported protocol
3. Issue specially crafted optimizer-influencing queries or packets
4. Cause hang or crash, repeating as needed for sustained DoS

How to detect it

Review MySQL error logs, slow query logs, and crash reports for repeated optimizer-related failures or abrupt terminations originating from authenticated low-privileged sessions; no specific threat actor TTPs are known.

What your security team should do

• Apply the appropriate MySQL patch immediately given the public disclosure date
• Restrict network access to MySQL instances to only trusted clients
• Monitor for availability anomalies in database logs and performance metrics
• Review downstream application dependencies on the affected MySQL versions