A new vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB) has been discovered, which affects the supported versions 8..34 and prior, and 8.1.. This easily exploitable vulnerability can be leveraged by a high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of the MySQL Server, leading to significant availability impacts.
The vulnerability has been assigned the CVE identifier CVE-2023-22068, with a CVSS 3.1 Base Score of 4.9, highlighting the availability impacts as the primary concern. The CVSS Vector for this vulnerability is (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
Code Snippet
There isn't a specific code snippet that can demonstrate this vulnerability, as it is reliant on an attacker leveraging their high privileged access to manipulate the internal workings of MySQL Server's InnoDB component. However, to better understand the version of MySQL Server you are running, you can use the following command:
SELECT @@version;
Once you have identified the version of MySQL Server, ensure that you are not running a vulnerable version to protect against this vulnerability.
Original References
For more information regarding this vulnerability, its potential impacts, and additional mitigation steps, please consult the following Oracle Advisory:
- Oracle Critical Patch Update Advisory - April 2023
Exploit Details
As mentioned earlier, this vulnerability can be exploited by a high privileged attacker with network access via multiple protocols. Although the specific attack vectors may vary depending on the environment and access level of the attacker, a successful attack can lead to an unauthorized ability to cause a hang or frequent crashes of the MySQL Server, resulting in complete denial of service.
Mitigation Recommendations
To mitigate the risks associated with this vulnerability, Oracle recommends updating the affected versions of MySQL Server to more recent and secure versions:
- For MySQL Server 8., update to the latest release 8..xx (check the MySQL Server Downloads page for new releases)
- For MySQL Server 8.1, update to the latest release 8.1.xx (check the MySQL Server Downloads page for new releases)
Conclusion
CVE-2023-22068 poses a significant threat to MySQL Server installations with specific vulnerable versions, allowing a high privileged attacker to cause complete denial of service. It is crucial for affected users to update their MySQL Server software to more secure versions to protect against this vulnerability. Regularly applying security updates and patches, along with monitoring security advisories, is a strong preventive measure to minimize the chances of successful attacks on your systems.
Timeline
Published on: 10/17/2023 22:15:00 UTC
Last modified on: 10/18/2023 17:56:00 UTC