CVE-2024-21171
📋 TL;DR
This vulnerability in MySQL Server's Optimizer component allows low-privileged attackers with network access to cause a denial of service (DoS) by crashing or hanging the server. It affects MySQL 8.0.37 and earlier, and 8.4.0 and earlier versions. Attackers need only low privileges and network access via multiple protocols to exploit this vulnerability.
💻 Affected Systems
- Oracle MySQL Server
📦 What is this software?
Mysql by Oracle
Mysql by Oracle
⚠️ Risk & Real-World Impact
Worst Case
Complete unavailability of MySQL Server leading to application downtime and service disruption
Likely Case
Targeted DoS attacks causing service interruptions for MySQL-dependent applications
If Mitigated
Limited impact if proper network segmentation and privilege controls are implemented
🎯 Exploit Status
CVSS indicates 'easily exploitable' with low attack complexity; requires authenticated access but only low privileges
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: MySQL 8.0.38 and 8.4.1 or later
Vendor Advisory: https://www.oracle.com/security-alerts/cpujul2024.html
Restart Required: Yes
Instructions:
1. Download latest MySQL version from Oracle website 2. Backup databases 3. Stop MySQL service 4. Apply patch/upgrade 5. Restart MySQL service 6. Verify functionality
🔧 Temporary Workarounds
Network Access Restriction
allRestrict network access to MySQL servers to only trusted hosts/IPs
# In MySQL my.cnf: bind-address = trusted_ip
# Use firewall: iptables -A INPUT -p tcp --dport 3306 -s trusted_ip -j ACCEPT
Privilege Minimization
allReview and minimize low-privileged accounts with network access
REVOKE ALL PRIVILEGES ON *.* FROM 'lowprivuser'@'%';
DROP USER 'lowprivuser'@'%';
🧯 If You Can't Patch
- Implement strict network segmentation and firewall rules to limit MySQL access
- Apply principle of least privilege and audit all low-privileged MySQL accounts
🔍 How to Verify
Check if Vulnerable:
Check MySQL version: SELECT VERSION(); - if version is 8.0.37 or earlier, or 8.4.0 or earlier, system is vulnerableCheck Version:
mysql -u root -p -e 'SELECT VERSION();'Verify Fix Applied:
After patching: SELECT VERSION(); should show 8.0.38+ or 8.4.1+📡 Detection & Monitoring
Log Indicators:
- MySQL crash logs
- Unexpected service restarts
- Error logs showing optimizer-related failures
Network Indicators:
- Multiple connection attempts from single source to MySQL
- Unusual query patterns targeting optimizer functions
SIEM Query:
source="mysql.log" ("crash" OR "segfault" OR "hang") AND "optimizer"