CVE-2025-21575
📋 TL;DR
A vulnerability in MySQL Server's parser component allows low-privileged attackers with network access to cause denial of service by crashing or hanging the server. This affects MySQL versions 8.0.0-8.0.41, 8.4.0-8.4.4, and 9.0.0-9.2.0. Attackers need only low privileges and network connectivity via multiple protocols.
💻 Affected Systems
- Oracle MySQL Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete unavailability of MySQL Server leading to application downtime and service disruption.
Likely Case
Intermittent or sustained denial of service affecting database-dependent applications.
If Mitigated
Limited impact if network access is restricted and least privilege principles are enforced.
🎯 Exploit Status
CVSS indicates easily exploitable with low attack complexity; requires low privileged credentials.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 8.0.41, 8.4.4, and 9.2.0 (check Oracle advisory for exact fixed versions)
Vendor Advisory: https://www.oracle.com/security-alerts/cpuapr2025.html
Restart Required: Yes
Instructions:
1. Review Oracle CPU advisory for exact fixed versions. 2. Apply MySQL patches from Oracle. 3. Restart MySQL service. 4. Verify version update.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict network access to MySQL Server to trusted hosts only.
# In MySQL my.cnf: bind-address = trusted_ip
# Use firewall: iptables -A INPUT -p tcp --dport 3306 -s trusted_ip -j ACCEPT
Least Privilege Enforcement
allMinimize low-privileged accounts and restrict their permissions.
REVOKE ALL PRIVILEGES ON *.* FROM 'lowprivuser'@'%';
DROP USER 'lowprivuser'@'%';
🧯 If You Can't Patch
- Implement strict network segmentation and firewall rules to limit MySQL access.
- Apply principle of least privilege: remove unnecessary low-privileged accounts and limit existing ones.
🔍 How to Verify
Check if Vulnerable:
Check MySQL version: SELECT VERSION(); If version falls within affected ranges, system is vulnerable.Check Version:
mysql -u root -p -e 'SELECT VERSION();'Verify Fix Applied:
After patching, verify version is outside affected ranges and test server stability under load.📡 Detection & Monitoring
Log Indicators:
- Unexpected MySQL crashes or hangs in error logs
- Multiple connection attempts from single low-privileged accounts
Network Indicators:
- Unusual traffic patterns to MySQL port 3306 from untrusted sources
- Repeated connection attempts with malformed queries
SIEM Query:
source="mysql_error.log" AND ("crash" OR "hang" OR "segmentation fault")