Login Sign Up

CVE-2022-27449

7.5 HIGH
Denial of Service

📋 TL;DR

CVE-2022-27449 is a segmentation fault vulnerability in MariaDB Server that can cause denial of service (DoS) by crashing the database service. It affects MariaDB Server versions 10.9 and below. Database administrators and organizations running vulnerable MariaDB instances are affected.

💻 Affected Systems

Products:
  • MariaDB Server
Versions: 10.9 and below (all versions up to and including 10.9)
Operating Systems: All operating systems running MariaDB
Default Config Vulnerable: ⚠️ Yes
Notes: All default configurations are vulnerable. The vulnerability is triggered via specific SQL function calls in the item_func.cc component.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Mariadb by Mariadb

View all CVEs affecting Mariadb →

Mariadb by Mariadb

View all CVEs affecting Mariadb →

Mariadb by Mariadb

View all CVEs affecting Mariadb →

Mariadb by Mariadb

View all CVEs affecting Mariadb →

Mariadb by Mariadb

View all CVEs affecting Mariadb →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete database service crash leading to extended downtime, data unavailability, and potential data corruption if crash occurs during critical operations.

🟠

Likely Case

Service disruption and denial of service affecting applications dependent on the database, requiring manual restart of MariaDB service.

🟢

If Mitigated

Minimal impact with proper monitoring and automated recovery procedures in place to restart services quickly.

🌐 Internet-Facing: MEDIUM - Internet-facing databases could be targeted for DoS attacks, but exploitation requires specific conditions.
🏢 Internal Only: LOW - Internal databases have reduced attack surface but could still be affected by malicious insiders or compromised internal systems.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ✅ No
Complexity: MEDIUM

Exploitation requires database access to execute specific SQL queries that trigger the segmentation fault. No public exploit code has been identified.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: MariaDB 10.9.1 and later

Vendor Advisory: https://jira.mariadb.org/browse/MDEV-28089

Restart Required: Yes

Instructions:

1. Backup databases and configuration files. 2. Stop MariaDB service. 3. Upgrade to MariaDB 10.9.1 or later using your package manager. 4. Restart MariaDB service. 5. Verify successful upgrade and service operation.

🔧 Temporary Workarounds

Restrict database user privileges

all

Limit user permissions to reduce attack surface by preventing execution of functions that could trigger the vulnerability.

REVOKE EXECUTE ON *.* FROM 'username'@'host';
GRANT SELECT, INSERT, UPDATE, DELETE ON database.* TO 'username'@'host';

Implement connection rate limiting

linux

Use firewall or database proxy to limit connection rates and prevent DoS attempts.

iptables -A INPUT -p tcp --dport 3306 -m limit --limit 60/min --limit-burst 100 -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -j DROP

🧯 If You Can't Patch

  • Implement network segmentation to isolate MariaDB servers from untrusted networks.
  • Deploy database activity monitoring to detect and alert on suspicious queries that could trigger the vulnerability.

🔍 How to Verify

Check if Vulnerable:

Check MariaDB version: mysql --version or SELECT VERSION();. If version is 10.9 or below, system is vulnerable.

Check Version:

mysql --version || SELECT VERSION();

Verify Fix Applied:

After patching, verify version is 10.9.1 or later using SELECT VERSION(); and ensure MariaDB service runs without segmentation faults.

📡 Detection & Monitoring

Log Indicators:

  • Segmentation fault errors in MariaDB error logs
  • Unexpected service restarts in system logs
  • Core dump files in MariaDB data directory

Network Indicators:

  • Unusual SQL function call patterns to MariaDB port 3306
  • Multiple failed connection attempts followed by service unavailability

SIEM Query:

source="mariadb_error.log" AND "segmentation fault" OR source="system.log" AND "mariadb" AND ("crash" OR "restart")

📊 Metadata

CVE ID: CVE-2022-27449
CVSS v3 Score: 7.5 (HIGH)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: April 14, 2022
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON