MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_xbstream.cc, when an error occurs (stream_ctxt->dest_file == NULL) while executing the method xbstream_open, the held lock is not released correctly, which allows local users to trigger a denial of service due to the deadlock. Note: The vendor argues this is just an improper locking bug and not a vulnerability with adverse effects.
References
| Link | Resource |
|---|---|
| https://jira.mariadb.org/browse/MDEV-26574?filter=-2 | Issue Tracking Permissions Required Third Party Advisory |
| https://github.com/MariaDB/server/commit/b1351c15946349f9daa7e5297fb2ac6f3139e4a8 | Patch Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20220707-0006/ | Third Party Advisory |
| https://jira.mariadb.org/browse/MDEV-26574 | |
| https://jira.mariadb.org/browse/MDEV-26561 |
Configurations
Configuration 1 (hide)
|
History
02 May 2024, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_xbstream.cc, when an error occurs (stream_ctxt->dest_file == NULL) while executing the method xbstream_open, the held lock is not released correctly, which allows local users to trigger a denial of service due to the deadlock. Note: The vendor argues this is just an improper locking bug and not a vulnerability with adverse effects. | |
| References |
|
Information
Published : 2022-05-25 21:15
Updated : 2024-10-30 14:35
NVD link : CVE-2022-31621
Mitre link : CVE-2022-31621
JSON object : View
Products Affected
mariadb
- mariadb
CWE
CWE-667
Improper Locking