CVE-2024-21238 - Vulnerability in MySQL Server: Thread Pooling, Resulting in Denial of Service Attacks

A security vulnerability has been discovered in the MySQL Server product of Oracle MySQL. The vulnerability affects the Server: Thread Pooling component and has been assigned the identifier CVE-2024-21238. This vulnerability allows a low privileged attacker with network access to exploit MySQL Server through multiple protocols, potentially causing a hang or frequently repeatable crash (complete Denial of Service - DOS) of the system. The affected MySQL Server versions include 8..39 and prior, 8.4.1 and prior, and 9..1 and prior. The CVSS 3.1 base score for this vulnerability is 5.3, with the vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).

Code Snippet

The vulnerability lies in the Thread Pooling component of the MySQL Server. Here is a simple example of how a thread pool can be created and utilized:

#include <iostream>
#include <thread>
#include <vector>
#include <future>
#include <mutex>
#include <queue>
#include <condition_variable>

class ThreadPool {
public:
  ThreadPool(size_t n) : stop(false) {
    for (size_t i = ; i < n; ++i) {
      workers.emplace_back([this] {
        while (true) {
          std::function<void()> task;
          {
            std::unique_lock<std::mutex> lock(this->queue_mutex);
            this->condition.wait(lock,
                                 [this] { return this->stop || !this->tasks.empty(); });
            if (this->stop && this->tasks.empty()) {
              return;
            }
            task = std::move(this->tasks.front());
            this->tasks.pop();
          }
          task();
        }
      });
    }
  }

  ThreadPool(const ThreadPool &) = delete;
  ThreadPool &operator=(const ThreadPool &) = delete;

  ~ThreadPool() {
    {
      std::unique_lock<std::mutex> lock(queue_mutex);
      stop = true;
    }
    condition.notify_all();
    for (std::thread &worker : workers) {
      worker.join();
    }
  }
};

Exploit Details

The vulnerability is difficult to exploit, as it requires both network access and low privileged access to the affected system. The attacker would also need to be familiar with the MySQL Server architecture and the Thread Pooling component. Successful exploitation of this vulnerability could result in the attacker gaining unauthorized ability to cause a hang or repeatable crash of the MySQL Server.

Original References

- Oracle Critical Patch Update Advisory - July 2024: Link
- MySQL Documentation: Thread Pooling: Link
- NVD - CVE-2024-21238: Link
- Details of CVE-2024-21238 from the official MySQL website: Link

Mitigation

Upgrade to a newer version of the MySQL server that is not affected by this vulnerability. This may include MySQL Server versions 8..40, 8.4.2, or 9..2 and later. Keep an eye on the Oracle Security Alerts and MySQL Security updates to be informed about the latest vulnerabilities and the corresponding patches. Regularly apply these updates to your MySQL server installation as they become available.

Conclusion

The CVE-2024-21238 vulnerability is a serious issue affecting the Thread Pooling component of MySQL Server, allowing an attacker to disrupt the normal operation of the server. While the difficulty of exploiting this vulnerability is high, it is recommended to upgrade your MySQL server to the patched versions to mitigate the risk of a successful attack. Keep yourself informed and up to date on the latest security patches for your server and apply them promptly in order to maintain a secure system.

Timeline

Published on: 10/15/2024 20:15:13 UTC
Last modified on: 10/16/2024 20:40:07 UTC