Improper Resource Shutdown or Release in MariaDB
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2022-31624 |
| CWE-ID | CWE-404 |
| Exploitation vector | Local |
| Public exploit | N/A |
| Vulnerable software Subscribe |
MariaDB Operating systems & Components / Operating system package or component |
| Vendor | Debian |
Security Bulletin
This security bulletin contains one low risk vulnerability.
1) Improper Resource Shutdown or Release
EUVDB-ID: #VU63828
Risk: Low
CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-31624
CWE-ID:
CWE-404 - Improper Resource Shutdown or Release
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service attack.
The vulnerability exists due to improper release of held lock lock_bigbuffer when processing plugin/server_audit/server_audit.c method log_statement_ex. A local user can perform a denial of service attack due to the deadlock.
MitigationInstall updates from vendor's website.
Vulnerable software versionsMariaDB: 10.0.0 - 10.9.1
External linkshttp://jira.mariadb.org/browse/MDEV-26556?filter=-2
http://github.com/MariaDB/server/commit/d627d00b13ab2f2c0954ea7b77202470cb102944
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
