CVE-2022-21278
📋 TL;DR
This vulnerability in MySQL Server's optimizer component allows authenticated attackers with network access to cause denial of service (server crashes/hangs) and modify some database data. It affects MySQL Server versions 8.0.26 and earlier. Attackers need only low privileges to exploit this vulnerability.
💻 Affected Systems
- Oracle MySQL Server
📦 What is this software?
Mysql by Oracle
⚠️ Risk & Real-World Impact
Worst Case
Complete MySQL Server outage causing application downtime, combined with unauthorized data modification in affected tables.
Likely Case
Service disruption through repeated crashes or hangs, potentially leading to data integrity issues in vulnerable tables.
If Mitigated
Limited impact if proper network segmentation and privilege restrictions are in place, though authenticated users could still cause disruption.
🎯 Exploit Status
Oracle describes as 'easily exploitable' but requires authenticated access. No public exploit code identified in references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: MySQL 8.0.27 and later
Vendor Advisory: https://www.oracle.com/security-alerts/cpujan2022.html
Restart Required: Yes
Instructions:
1. Backup databases. 2. Upgrade MySQL Server to version 8.0.27 or later. 3. Restart MySQL service. 4. Verify upgrade with version check.
🔧 Temporary Workarounds
Network Access Restriction
allLimit network access to MySQL Server to only trusted hosts/networks
# In my.cnf: bind-address = trusted_ip
# Firewall: iptables -A INPUT -p tcp --dport 3306 -s trusted_network -j ACCEPT
Privilege Minimization
allReview and reduce privileges for all MySQL user accounts to minimum required
REVOKE ALL PRIVILEGES ON *.* FROM 'user'@'host';
GRANT SELECT, INSERT, UPDATE, DELETE ON specific_db.* TO 'user'@'host';
🧯 If You Can't Patch
- Implement strict network segmentation and firewall rules to limit MySQL access
- Apply principle of least privilege to all database accounts and monitor for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check MySQL version: SELECT VERSION(); If version is 8.0.26 or earlier, system is vulnerable.Check Version:
mysql -V or SELECT VERSION();Verify Fix Applied:
After upgrade, verify version is 8.0.27 or later: SELECT VERSION();📡 Detection & Monitoring
Log Indicators:
- Unexpected MySQL crashes/restarts
- Error logs showing optimizer-related failures
- Authentication logs showing low-privilege account abuse
Network Indicators:
- Unusual query patterns from low-privilege accounts
- Multiple connection attempts followed by crashes
SIEM Query:
source="mysql_error.log" AND ("crash" OR "segfault" OR "optimizer")