CVE-2024-20975 in MySQL Server
Summary
by MITRE • 01/17/2024
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.2.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 02/10/2024
The vulnerability identified as CVE-2024-20975 resides within the MySQL Server optimizer component of Oracle MySQL, affecting versions 8.2.0 and earlier. This represents a critical availability-focused weakness that demonstrates how database optimization logic can become a vector for denial of service attacks. The vulnerability operates at the core of MySQL's query execution engine where the optimizer processes and plans database operations, making it particularly dangerous as it can disrupt fundamental database functionality. The affected component specifically handles query optimization routines that are invoked during database operations, creating a potential attack surface where malicious input could trigger unintended behavior in the server's execution path.
This vulnerability manifests as an easily exploitable flaw that requires minimal privileges for successful exploitation, allowing attackers with network access through multiple protocols to compromise the target system. The low privilege requirement indicates that even users with basic database access rights could potentially trigger this vulnerability, making it particularly concerning for environments where database access is more widely distributed. The attack vector operates over network protocols, meaning that remote exploitation is possible without requiring physical access to the server infrastructure. The vulnerability's classification as a complete denial of service means that successful exploitation can cause the MySQL server to hang or repeatedly crash, effectively rendering the database service unavailable to legitimate users and applications that depend on it.
The technical impact of this vulnerability aligns with CWE-400, which addresses "Uncontrolled Resource Consumption" and specifically relates to resource exhaustion that can lead to system unavailability. The CVSS 3.1 scoring of 6.5 reflects the availability impact severity, with the attack complexity being low and the privilege requirement being low, indicating that the attack can be executed with minimal technical skill and access. The vector notation AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H clearly demonstrates that this vulnerability affects the availability aspect of the system with no user interaction required, no additional privileges needed beyond basic network access, and potentially affects the entire system. The complete DOS condition means that the MySQL server cannot be easily recovered without manual intervention, as the service will either hang or crash repeatedly until the underlying issue is resolved through patching or service restart.
Organizations affected by this vulnerability should immediately implement mitigation strategies focusing on network segmentation and access control measures to limit exposure. The recommended approach involves applying the vendor-provided patches as soon as they become available, which would address the underlying optimization logic flaw. Additionally, implementing network monitoring solutions can help detect anomalous patterns that might indicate exploitation attempts. Database administrators should also consider implementing connection throttling and query timeout mechanisms to limit the potential impact of exploitation attempts. The vulnerability's impact extends beyond simple service disruption as it can affect business continuity and data availability, making prompt remediation essential for maintaining operational integrity. Security teams should also review their incident response procedures to ensure they can quickly identify and respond to potential exploitation attempts targeting this specific vulnerability.