CVE-2024-21203
📋 TL;DR
This vulnerability in Oracle MySQL Server's Full-Text Search (FTS) component allows high-privileged attackers with network access to cause a denial of service by crashing or hanging the server. It affects MySQL Server versions 8.0.39 and prior, 8.4.2 and prior, and 9.0.1 and prior. Attackers need administrative database privileges but can exploit it easily via multiple network protocols.
💻 Affected Systems
- Oracle MySQL Server
📦 What is this software?
Mysql by Oracle
Mysql by Oracle
Mysql by Oracle
Mysql by Oracle
⚠️ Risk & Real-World Impact
Worst Case
Complete unavailability of MySQL Server leading to application downtime and service disruption.
Likely Case
Targeted DoS attacks against vulnerable MySQL instances by malicious insiders or compromised admin accounts.
If Mitigated
Limited impact if proper network segmentation and privilege controls prevent unauthorized admin access.
🎯 Exploit Status
Oracle describes as 'easily exploitable' but requires high privileges. No public exploit code identified in references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.0.40, 8.4.3, 9.0.2 or later
Vendor Advisory: https://www.oracle.com/security-alerts/cpuoct2024.html
Restart Required: Yes
Instructions:
1. Download patched MySQL version from Oracle. 2. Backup databases. 3. Stop MySQL service. 4. Install update. 5. Restart MySQL service. 6. Verify version and functionality.
🔧 Temporary Workarounds
Restrict Admin Access
allLimit high-privilege database accounts to trusted sources only
REVOKE ALL PRIVILEGES ON *.* FROM 'admin_user'@'%';
GRANT SELECT, INSERT, UPDATE, DELETE ON specific_db.* TO 'admin_user'@'trusted_ip';
Network Segmentation
linuxRestrict MySQL port access to application servers only
iptables -A INPUT -p tcp --dport 3306 -s app_server_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -j DROP
🧯 If You Can't Patch
- Implement strict principle of least privilege for database accounts
- Monitor for unusual admin account activity and failed connection attempts
🔍 How to Verify
Check if Vulnerable:
Run 'SELECT VERSION();' in MySQL and compare against affected versionsCheck Version:
mysql --version OR SELECT VERSION();Verify Fix Applied:
Check version is 8.0.40+, 8.4.3+, or 9.0.2+ and test FTS functionality📡 Detection & Monitoring
Log Indicators:
- Multiple connection attempts from unusual sources
- Unexpected server crashes or restarts
- FTS-related error messages in MySQL logs
Network Indicators:
- Unusual traffic patterns to MySQL port 3306
- Multiple rapid connections from single source
SIEM Query:
source="mysql.log" AND ("crash" OR "hang" OR "shutdown") AND NOT "normal"