CVE-2024-57661

What it actually does

Crafted SQL statements trigger a denial of service condition in the sqlo_df component of the database engine.

Why it matters to the business

Successful exploitation can interrupt database availability and dependent services; remediation is available via updated Ubuntu packages with no known active exploitation or ransomware use.

How an attack unfolds

An attacker with the ability to submit SQL statements supplies specially crafted queries that reach the sqlo_df component and cause the server process to crash or hang.

How to fix it

Upgrade affected packages to the listed fixed versions: libxmltok on Ubuntu 16.04 to 1.2-3ubuntu0.16.04.1~esm2, on 18.04 to 1.2-4ubuntu0.18.04.1~esm4, on 20.04/22.04 to 1.2-4ubuntu0.20.04.1~esm4 or 1.2-4ubuntu0.22.04.1~esm4, on 24.04 to 1.2-4.1ubuntu2.24.0.4.1+esm2; expat on 14.04 to 2.1.0-4ubuntu1.2 and on 16.04 to 2.1.0-7ubuntu0.16.04.1. Apply all available security updates and restart affected services.

How to confirm the fix worked

Verify package versions match the fixed releases listed for each Ubuntu release; confirm the sqlo_df component no longer accepts the previously crashing SQL patterns in a test environment.

Typical attack path

1. Obtain network or local access permitting SQL statement submission to the target instance
2. Craft and submit malicious SQL statements targeting the sqlo_df component
3. Trigger repeated crashes to sustain denial of service

How to detect it

Review database query logs and process crash reports for repeated malformed SQL statements or sudden server terminations; correlate with authentication events if available.

What your security team should do

• Apply the exact fixed package versions immediately on all affected Ubuntu systems
• Restrict direct SQL submission privileges to trusted accounts only
• Monitor for unusual query patterns or repeated server restarts in database logs
• Test updates in a staging environment before production rollout