Vulnerability identifier: #VU63830
Vulnerability risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID:
CWE-ID:
CWE-667
Exploitation vector: Local
Exploit availability: No
Vulnerable software:
MariaDB
Operating systems & Components /
Operating system package or component
Vendor: Debian
Description
The vulnerability allows a local user to perform a denial of service attack (DoS) on the target system.
The vulnerability exists due to double-locking error in the extra/mariabackup/ds_compress.cc. A local user can exploit this vulnerability to cause a deadlock, resulting in a denial of service condition.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
MariaDB: 10.0.0 - 10.0.38, 10.1.0 - 10.1.48, 10.2.0 - 10.2.44, 10.3.0 - 10.3.35, 10.4.0 - 10.4.25, 10.5.0 - 10.5.16, 10.6.0 - 10.6.8, 10.7.1 - 10.7.4, 10.8.1 - 10.8.3, 10.9.1
External links
https://github.com/MariaDB/server/pull/1938
https://github.com/MariaDB/server/commit/7c30bc38a588b22b01f11130cfe99e7f36accf94
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.