CVE-2022-27380 – A vulnerability in MariaDB Server's my

Q: What is the severity of CVE-2022-27380?

CVE-2022-27380 has a CVSS score of 7.5 (HIGH). A vulnerability in MariaDB Server's my_decimal::operator= component allows attackers to cause Denial of Service (DoS) through specially crafted SQL statements. This affects MariaDB Server versions 10.6.3 and below, potentially disrupting database availability for applications using these versions.

📋 TL;DR

A vulnerability in MariaDB Server's my_decimal::operator= component allows attackers to cause Denial of Service (DoS) through specially crafted SQL statements. This affects MariaDB Server versions 10.6.3 and below, potentially disrupting database availability for applications using these versions.

💻 Affected Systems

Products:

MariaDB Server

Versions: 10.6.3 and below

Operating Systems: All operating systems running affected MariaDB versions

Default Config Vulnerable: ⚠️ Yes

Notes: All default configurations are vulnerable if using affected versions

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete database service disruption leading to application downtime and data unavailability

🟠

Likely Case

Database service crashes requiring restart, causing temporary application disruption

🟢

If Mitigated

Minimal impact with proper network segmentation and query filtering

🌐 Internet-Facing: HIGH - Internet-facing MariaDB instances are directly exposed to crafted SQL attacks

🏢 Internal Only: MEDIUM - Internal systems still vulnerable to authenticated users or compromised accounts

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires ability to execute SQL statements against the database

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: MariaDB 10.6.4 and later

Vendor Advisory: https://jira.mariadb.org/browse/MDEV-26280

Restart Required: Yes

Instructions:

1. Backup databases. 2. Upgrade MariaDB to version 10.6.4 or later. 3. Restart MariaDB service. 4. Verify version and functionality.

🔧 Temporary Workarounds

SQL Query Filtering

all

Implement input validation and filtering for decimal operations in SQL queries

Network Access Control

all

Restrict database access to trusted applications and users only

🧯 If You Can't Patch

Implement strict network segmentation to isolate MariaDB instances
Deploy web application firewall (WAF) with SQL injection protection rules

🔍 How to Verify

Check if Vulnerable:

Check MariaDB version: mysql --version or SELECT VERSION();

Check Version:

mysql --version

Verify Fix Applied:

Confirm version is 10.6.4 or later and test decimal operations

📡 Detection & Monitoring

Log Indicators:

Database crash logs
Unexpected service restarts
Error messages related to decimal operations

Network Indicators:

Unusual SQL query patterns targeting decimal functions

SIEM Query:

source="mariadb.log" AND ("crash" OR "segfault" OR "decimal")

📊 Metadata

CVE ID: CVE-2022-27380

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-89

Published: April 12, 2022

Last Updated: November 21, 2024

🔗 References

https://jira.mariadb.org/browse/MDEV-26280 Exploit,Issue Tracking,Vendor Advisory
https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html Mailing List,Third Party Advisory
https://security.netapp.com/advisory/ntap-20220526-0007/ Third Party Advisory
https://jira.mariadb.org/browse/MDEV-26280 Exploit,Issue Tracking,Vendor Advisory
https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html Mailing List,Third Party Advisory
https://security.netapp.com/advisory/ntap-20220526-0007/ Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-27380, you might also want to check these:

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Mariadb by Mariadb

Mariadb by Mariadb

Mariadb by Mariadb

Mariadb by Mariadb

Mariadb by Mariadb

Mariadb by Mariadb

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

SQL Query Filtering

Network Access Control

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities