CVE-2024-21165
📋 TL;DR
This vulnerability in MySQL Server's Pluggable Authentication component allows high-privileged attackers with network access to cause a denial of service by crashing or hanging the server. It affects MySQL Server versions 8.0.37 and earlier. The impact is limited to availability disruption rather than data compromise.
💻 Affected Systems
- Oracle MySQL Server
📦 What is this software?
Mysql by Oracle
⚠️ Risk & Real-World Impact
Worst Case
Complete MySQL Server outage causing application downtime and service disruption until manual restart.
Likely Case
Targeted DoS attacks against vulnerable MySQL instances by authorized attackers, causing intermittent service interruptions.
If Mitigated
Minimal impact if proper network segmentation and privilege controls prevent unauthorized high-privileged access.
🎯 Exploit Status
Exploitation requires high-privileged attacker credentials but is described as 'easily exploitable' by Oracle.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: MySQL 8.0.38 or later
Vendor Advisory: https://www.oracle.com/security-alerts/cpujul2024.html
Restart Required: Yes
Instructions:
1. Download MySQL 8.0.38 or later from Oracle. 2. Backup databases and configuration. 3. Stop MySQL service. 4. Install updated version. 5. Restart MySQL service. 6. Verify functionality.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict network access to MySQL servers to only trusted hosts and applications
iptables -A INPUT -p tcp --dport 3306 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -j DROP
Privilege Reduction
allReview and minimize high-privileged database accounts
SHOW GRANTS FOR 'user'@'host';
REVOKE SUPER ON *.* FROM 'user'@'host';
🧯 If You Can't Patch
- Implement strict network segmentation to isolate MySQL servers from untrusted networks
- Enforce principle of least privilege for all database accounts and monitor for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Run 'SELECT VERSION();' in MySQL and check if version is 8.0.37 or earlierCheck Version:
mysql --versionVerify Fix Applied:
Confirm MySQL version is 8.0.38 or later using 'SELECT VERSION();'📡 Detection & Monitoring
Log Indicators:
- Unexpected MySQL crashes or hangs
- Authentication failures followed by service disruption
- Error logs showing Pluggable Auth component failures
Network Indicators:
- Multiple authentication attempts from single source followed by service unavailability
- Unusual traffic patterns to MySQL authentication ports
SIEM Query:
source="mysql.log" ("crash" OR "hang" OR "shutdown") AND "pluggable auth"