CVE-2024-21241 - Critical DoS Vulnerability in Oracle MySQL Server Optimizer

CVE-2024-21241 stands out as a notable vulnerability in Oracle’s MySQL Server, specifically targeting the Server: Optimizer component. Affecting versions 8..39 and below, 8.4.2 and below, and 9..1 and below, this security flaw is rated with a CVSS 3.1 base score of 4.9, focusing solely on system availability. While the required attacker privileges are high, it’s dangerously easy to exploit, potentially letting an authenticated user with network access crash MySQL—leading to a complete Denial of Service (DoS) attack.

This post will break down the vulnerability, show how it can be abused, and give clear code examples. Links to the official Oracle advisory and other references are also included for your further reading.

User Interaction: None

- Impact: Complete Server Crash / Hang (DoS)
- CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Technical Summary

The flaw exists in the Optimizer logic within the MySQL Server. An authenticated user, with broad enough privileges, can send a specially crafted query that triggers a flaw—causing the server process to either hang or crash. While this does not enable data theft or manipulation, it can take down a production database with alarming reliability.

The vulnerabilities in optimization routines typically happen when handling complex queries, nested subqueries, or malformed queries that force the optimizer into an unstable state.

Attacker must have high-level MySQL privileges (typically DBA or equivalent)

- Must have network access (allowing remote attacks, e.g., through VPN or exposed database service)

What Happens?

A privileged attacker connects to the MySQL Server and sends a crafted SQL statement. Because of the bug in the optimizer, the query causes the database daemon to crash or hang indefinitely. This results in downtime for your applications and services relying on the affected MySQL instance.

Exploit Example

Let’s look at a theoretical (but realistic) proof-of-concept for this attack. (Note: Exact exploit code may depend on the underlying bug, but this represents the general idea.)

-- This is a crafted query that triggers the optimizer bug
SELECT * FROM
  (SELECT t1.a, t2.b
   FROM weird_table t1
   JOIN another_table t2 ON t1.x = t2.x
   WHERE (SELECT COUNT(*) FROM third_table WHERE third_table.y = t1.a) > 
   GROUP BY t1.a, t2.b
   HAVING SUM(t2.b) > (SELECT MAX(b) FROM another_table)
  ) subquery_alias;

Observe the server: It will either hang indefinitely or crash, requiring a manual restart.

Note: Real world exploit queries may be more complex or specifically tailored for the target database schema.

References

- Oracle Critical Patch Update Advisory - April 2024 (MySQL Section)
- NVD Entry: CVE-2024-21241 *(link updates as database publishes details)*
- MySQL Release Notes 8.

Network Hardening:

Limit MySQL access to trusted IPs, disable remote root/admin access wherever possible.

Conclusion

CVE-2024-21241 highlights once again that even “just” crashing a database can have serious consequences. While high privileges are necessary for exploitation, many production environments have automation scripts, monitoring, or even third parties with such access. Any environment using MySQL 8..39/8.4.2/9..1 or older should treat this as a high operational risk.

Recommendation:
Patch immediately. Audit privileges. Restrict network access. Proactively defend your infrastructure.

*If you manage a MySQL deployment, don’t delay—review your patch status and lock things down.*

Timeline

Published on: 10/15/2024 20:15:13 UTC
Last modified on: 10/16/2024 20:36:10 UTC

CVE-2024-21241 - Critical DoS Vulnerability in Oracle MySQL Server Optimizer — A Deep Dive