Oracle MySQL Server up to 5.7.41/8.0.31 InnoDB out-of-bounds write

Summaryinfo

A vulnerability has been found in Oracle MySQL Server up to 5.7.41/8.0.31 and classified as very critical. Impacted is an unknown function of the component InnoDB. The manipulation leads to an unknown weakness. This vulnerability is traded as CVE-2022-37434. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as very critical, has been found in Oracle MySQL Server up to 5.7.41/8.0.31 (Database Software). This issue affects an unknown part of the component InnoDB. Using CWE to declare the problem leads to CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability.

The weakness was shared 04/18/2023 as Oracle Critical Patch Update Advisory - April 2023. The advisory is shared at oracle.com. The identification of this vulnerability is CVE-2022-37434. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 05/02/2025).

We expect the 0-day to have been worth approximately $25k-$100k. The vulnerability scanner Nessus provides a plugin with the ID 215940 (Azure Linux 3.0 Security Update: cloud-hypervisor-cvm / crash / zlib (CVE-2022-37434)), which helps to determine the existence of the flaw in a target environment.

A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (215940). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Database Software

Vendor

• Oracle

Name

• MySQL Server

Version

• 5.7.0
• 5.7.1
• 5.7.2
• 5.7.3
• 5.7.4
• 5.7.5
• 5.7.6
• 5.7.7
• 5.7.8
• 5.7.9
• 5.7.10
• 5.7.11
• 5.7.12
• 5.7.13
• 5.7.14
• 5.7.15
• 5.7.16
• 5.7.17
• 5.7.18
• 5.7.19
• 5.7.20
• 5.7.21
• 5.7.22
• 5.7.23
• 5.7.24
• 5.7.25
• 5.7.26
• 5.7.27
• 5.7.28
• 5.7.29
• 5.7.30
• 5.7.31
• 5.7.32
• 5.7.33
• 5.7.34
• 5.7.35
• 5.7.36
• 5.7.37
• 5.7.38
• 5.7.39
• 5.7.40
• 5.7.41
• 8.0.0
• 8.0.1
• 8.0.2
• 8.0.3
• 8.0.4
• 8.0.5
• 8.0.6
• 8.0.7
• 8.0.8
• 8.0.9
• 8.0.10
• 8.0.11
• 8.0.12
• 8.0.13
• 8.0.14
• 8.0.15
• 8.0.16
• 8.0.17
• 8.0.18
• 8.0.19
• 8.0.20
• 8.0.21
• 8.0.22
• 8.0.23
• 8.0.24
• 8.0.25
• 8.0.26
• 8.0.27
• 8.0.28
• 8.0.29
• 8.0.30
• 8.0.31

License

• open-source

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion