CVE-2023-21912
📋 TL;DR
This vulnerability in MySQL Server allows unauthenticated attackers with network access to cause a denial of service (DoS) by crashing or hanging the server. It affects MySQL 5.7.41 and earlier, and 8.0.30 and earlier. The vulnerability is in the Security: Privileges component and can be exploited via multiple protocols.
💻 Affected Systems
- Oracle MySQL Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete unavailability of MySQL Server, disrupting all database-dependent applications and services.
Likely Case
Service disruption causing application downtime and potential data loss from interrupted transactions.
If Mitigated
Limited impact if network access is restricted and proper monitoring detects attack patterns early.
🎯 Exploit Status
Oracle describes it as 'easily exploitable' with unauthenticated network access via multiple protocols.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: MySQL 5.7.42 and 8.0.31 or later
Vendor Advisory: https://www.oracle.com/security-alerts/cpuapr2023.html
Restart Required: Yes
Instructions:
1. Download the patched version from Oracle's website. 2. Backup your database. 3. Stop MySQL service. 4. Install the update. 5. Restart MySQL service. 6. Verify the new version is running.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict network access to MySQL to only trusted IP addresses and applications.
# Configure MySQL bind-address to specific IP
bind-address = 192.168.1.100
# Use firewall rules
iptables -A INPUT -p tcp --dport 3306 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation and firewall rules to limit access to MySQL ports (default 3306).
- Deploy intrusion detection/prevention systems to monitor for unusual connection patterns to MySQL.
🔍 How to Verify
Check if Vulnerable:
Check MySQL version: If version is 5.7.41 or earlier, or 8.0.30 or earlier, the system is vulnerable.Check Version:
mysql --version OR SELECT VERSION();Verify Fix Applied:
After patching, verify MySQL version is 5.7.42+ or 8.0.31+ and test database connectivity and functionality.📡 Detection & Monitoring
Log Indicators:
- Unexpected MySQL crashes or hangs in error logs
- Multiple connection attempts from unknown sources
- Error messages related to privilege handling
Network Indicators:
- Unusual traffic patterns to MySQL port 3306
- Connection attempts from unexpected IP addresses
- Protocol anomalies in MySQL communications
SIEM Query:
source="mysql.log" ("crash" OR "hang" OR "segmentation fault") OR destination_port=3306 AND source_ip NOT IN (trusted_ips)