Login Sign Up

CVE-2024-41433

9.8 CRITICAL
Denial of Service Buffer Overflow

📋 TL;DR

CVE-2024-41433 is a buffer overflow vulnerability in PingCAP TiDB's expression.ExplainExpressionList component that allows attackers to cause Denial of Service through crafted queries. This affects TiDB v8.1.0 users who process untrusted SQL input. PingCAP disputes the DoS classification, calling it a complex query bug.

💻 Affected Systems

Products:
  • PingCAP TiDB
Versions: v8.1.0
Operating Systems: All platforms running TiDB
Default Config Vulnerable: ⚠️ Yes
Notes: Requires ability to execute SQL queries against TiDB instance.

📦 What is this software?

Tidb by Pingcap

View all CVEs affecting Tidb →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete TiDB service disruption through buffer overflow crashes, potentially affecting all connected applications and users.

🟠

Likely Case

Service instability or crashes for individual query sessions when processing malicious SQL expressions.

🟢

If Mitigated

Minimal impact with proper input validation and query filtering in place.

🌐 Internet-Facing: HIGH
🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes
Weaponized: LIKELY
Unauthenticated Exploit: ✅ No
Complexity: LOW

Exploit requires SQL query execution capability. Public PoC available in GitHub issue.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: v8.1.1 or later

Vendor Advisory: https://github.com/pingcap/tidb/issues/53796

Restart Required: Yes

Instructions:

1. Backup TiDB cluster. 2. Upgrade to TiDB v8.1.1 or later. 3. Restart TiDB services. 4. Verify upgrade completion.

🔧 Temporary Workarounds

Input Validation Filter

all

Implement application-layer validation to filter complex expression queries before reaching TiDB.

Query Rate Limiting

all

Implement rate limiting on SQL query execution to prevent rapid exploitation attempts.

🧯 If You Can't Patch

  • Implement strict SQL input validation at application layer
  • Restrict database access to trusted users only

🔍 How to Verify

Check if Vulnerable:

Check TiDB version: SELECT VERSION(); If version is exactly 8.1.0, system is vulnerable.

Check Version:

SELECT VERSION();

Verify Fix Applied:

After upgrade, confirm version is 8.1.1 or later: SELECT VERSION();

📡 Detection & Monitoring

Log Indicators:

  • TiDB crash logs
  • Unexpected service restarts
  • Memory allocation errors in logs

Network Indicators:

  • Unusual SQL query patterns with complex expressions
  • Sudden service unavailability

SIEM Query:

source="tidb.log" AND ("panic" OR "segmentation fault" OR "buffer overflow")

📊 Metadata

CVE ID: CVE-2024-41433
CVSS v3 Score: 9.8 (CRITICAL)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-120
Published: September 3, 2024
Last Updated: September 4, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-41433, you might also want to check these:

CVE-2023-24482 10.0

This CVE describes a critical buffer overflow vulnerability in COMOS software's cache validation ser...

Same vulnerability type (CWE-120)
CVE-2024-22039 10.0

This vulnerability allows unauthenticated remote attackers to execute arbitrary code with root privi...

Same vulnerability type (CWE-120)
CVE-2022-22570 10.0

A buffer overflow vulnerability in UniFi Door Access Reader Lite firmware allows attackers with netw...

Same vulnerability type (CWE-120)