CVE-2024-57644

What it actually does

Crafted SQL statements trigger a crash or hang in the itc_hash_compare component, resulting in denial of service against the database engine.

Why it matters to the business

Unexpected database outages can interrupt applications and services that rely on the database, causing operational downtime until the instance is restarted.

How an attack unfolds

An attacker with the ability to submit SQL statements identifies a reachable database instance and submits specially formed queries that exercise the vulnerable hash comparison logic, forcing the process to terminate or become unresponsive.

How to fix it

Upgrade to a patched release of the database server as soon as one becomes available from the vendor; in the interim restrict untrusted SQL submission and apply network-level controls to limit query sources.

How to confirm the fix worked

Review release notes for the presence of a fix addressing the hash comparison component; test connectivity and query handling after upgrade to confirm the service remains stable under previously crashing inputs.

Typical attack path

1. Locate an exposed or reachable instance of the database server
2. Obtain credentials or a channel that permits SQL statement submission
3. Craft and transmit a malicious SQL statement targeting the hash comparison routine
4. Observe service crash or unresponsiveness confirming denial of service

How to detect it

Inspect database query logs and error logs for repeated or unusual statements that precede service restarts or crashes; correlate with process termination events.

What your security team should do

• Monitor vendor announcements for an official patch and schedule upgrade at the earliest opportunity
• Restrict direct SQL access from untrusted sources until a fix is deployed
• Enable detailed query logging to support detection of anomalous statements