CVE-2024-57662

What it actually does

Crafted SQL statements trigger a crash or resource exhaustion in the sqlg_hash_source component, resulting in denial of service.

Why it matters to the business

Database services become unavailable, causing operational downtime and potential loss of access to data-dependent applications until the instance is restarted or patched.

How an attack unfolds

An attacker with network or local access to a Virtuoso instance crafts malicious SQL statements targeting the sqlg_hash_source component and submits them to induce a denial-of-service condition; no named threat actors or ransomware campaigns are associated with this issue.

How to fix it

Upgrade Virtuoso OpenSource to a version containing the fix for CVE-2024-57662; for listed Ubuntu packages apply the referenced kernel updates (for example linux 3.13.0-91.138 or linux-aws 4.4.0-1002.2) where applicable and restart affected services.

How to confirm the fix worked

Confirm the installed Virtuoso version is newer than 7.2.11, test that crafted SQL statements no longer cause a crash, and verify service availability after applying the referenced package updates.

Typical attack path

1. Locate an exposed or reachable Virtuoso instance running the affected version
2. Craft SQL statements designed to abuse the sqlg_hash_source component
3. Submit the statements via a client connection or application query path
4. Observe service crash or unresponsiveness confirming the denial-of-service state

How to detect it

Review database query logs and application error logs for repeated malformed SQL submissions that precede service crashes; no specific threat-actor indicators are known.

What your security team should do

• Prioritize patching Virtuoso instances and listed Ubuntu packages within standard change windows given the low EPSS and lack of KEV listing
• Review database access controls to limit untrusted SQL submission
• Monitor for service restarts or availability alerts on Virtuoso hosts