Log in Start free

Vulnerability · Published Feb 18, 2022 · Assigned by zdi

CVE-2022-24051

High 7.0

In plain English

A high-severity security flaw in MariaDB from MariaDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.0)7.0High
Exploit odds (30 days)0.7%top 48.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

MariaDB CONNECT Storage Engine Format String Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of a user-supplied string before using it as a format specifier. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16193.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8Judy1.0.5-18.module_el8.6.0+3139+3c630e87ALSA-2022:6443
AlmaLinux:8Judy1.0.5-18.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:8Judy1.0.5-18.module_el8.6.0+3072+3c630e87ALSA-2022:6443
AlmaLinux:8galera25.3.35-1.module_el8.6.0+3265+230ed96bALSA-2022:6443
AlmaLinux:8galera26.4.11-1.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:8mariadb3:10.3.35-1.module_el8.6.0+3265+230ed96bALSA-2022:6443
AlmaLinux:8mariadb3:10.5.16-2.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:9mariadb3:10.5.16-2.el9_0ALSA-2022:5948
AlmaLinux:8mariadb-backup3:10.3.35-1.module_el8.6.0+3265+230ed96bALSA-2022:6443
AlmaLinux:8mariadb-backup3:10.5.16-2.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:9mariadb-backup3:10.5.16-2.el9_0ALSA-2022:5948
AlmaLinux:8mariadb-common3:10.3.35-1.module_el8.6.0+3265+230ed96bALSA-2022:6443
AlmaLinux:8mariadb-common3:10.5.16-2.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:9mariadb-common3:10.5.16-2.el9_0ALSA-2022:5948
AlmaLinux:8mariadb-devel3:10.5.16-2.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:8mariadb-devel3:10.3.35-1.module_el8.6.0+3265+230ed96bALSA-2022:6443
AlmaLinux:9mariadb-devel3:10.5.16-2.el9_0ALSA-2022:5948
AlmaLinux:8mariadb-embedded3:10.3.35-1.module_el8.6.0+3265+230ed96bALSA-2022:6443
AlmaLinux:8mariadb-embedded3:10.5.16-2.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:9mariadb-embedded3:10.5.16-2.el9_0ALSA-2022:5948
AlmaLinux:8mariadb-embedded-devel3:10.5.16-2.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:8mariadb-embedded-devel3:10.3.35-1.module_el8.6.0+3265+230ed96bALSA-2022:6443
AlmaLinux:9mariadb-embedded-devel3:10.5.16-2.el9_0ALSA-2022:5948
AlmaLinux:8mariadb-errmsg3:10.5.16-2.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:8mariadb-errmsg3:10.3.35-1.module_el8.6.0+3265+230ed96bALSA-2022:6443
AlmaLinux:9mariadb-errmsg3:10.5.16-2.el9_0ALSA-2022:5948
AlmaLinux:8mariadb-gssapi-server3:10.3.35-1.module_el8.6.0+3265+230ed96bALSA-2022:6443
AlmaLinux:8mariadb-gssapi-server3:10.5.16-2.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:9mariadb-gssapi-server3:10.5.16-2.el9_0ALSA-2022:5948
AlmaLinux:8mariadb-oqgraph-engine3:10.5.16-2.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:8mariadb-oqgraph-engine3:10.3.35-1.module_el8.6.0+3265+230ed96bALSA-2022:6443
AlmaLinux:9mariadb-oqgraph-engine3:10.5.16-2.el9_0ALSA-2022:5948
AlmaLinux:8mariadb-pam3:10.5.16-2.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:9mariadb-pam3:10.5.16-2.el9_0ALSA-2022:5948
AlmaLinux:8mariadb-server3:10.5.16-2.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:8mariadb-server3:10.3.35-1.module_el8.6.0+3265+230ed96bALSA-2022:6443
AlmaLinux:9mariadb-server3:10.5.16-2.el9_0ALSA-2022:5948
AlmaLinux:8mariadb-server-galera3:10.3.35-1.module_el8.6.0+3265+230ed96bALSA-2022:6443
AlmaLinux:8mariadb-server-galera3:10.5.16-2.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:9mariadb-server-galera3:10.5.16-2.el9_0ALSA-2022:5948
AlmaLinux:8mariadb-server-utils3:10.5.16-2.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:8mariadb-server-utils3:10.3.35-1.module_el8.6.0+3265+230ed96bALSA-2022:6443
AlmaLinux:9mariadb-server-utils3:10.5.16-2.el9_0ALSA-2022:5948
AlmaLinux:8mariadb-test3:10.5.16-2.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:8mariadb-test3:10.3.35-1.module_el8.6.0+3265+230ed96bALSA-2022:6443
AlmaLinux:9mariadb-test3:10.5.16-2.el9_0ALSA-2022:5948
Alpine:v3.20mariadb10.6.7-r0ALPINE-CVE-2022-24051
Alpine:v3.21mariadb10.6.7-r0ALPINE-CVE-2022-24051
Alpine:v3.22mariadb10.6.7-r0ALPINE-CVE-2022-24051
Alpine:v3.23mariadb10.6.7-r0ALPINE-CVE-2022-24051
Alpine:v3.24mariadb10.6.7-r0ALPINE-CVE-2022-24051
Rocky Linux:8Judy0:1.0.5-18.module+el8.4.0+427+adf35707RLSA-2022:6443
Rocky Linux:8Judy0:1.0.5-18.module+el8.4.0+427+adf35707RLSA-2022:5826
Rocky Linux:8galera0:25.3.35-1.module+el8.6.0+1005+cdf19c22RLSA-2022:6443
Rocky Linux:8galera0:26.4.11-1.module+el8.6.0+995+5ac2a483RLSA-2022:5826
Rocky Linux:9galera0:26.4.11-1.el9_0RLSA-2022:5948
Rocky Linux:8mariadb3:10.3.35-1.module+el8.6.0+1005+cdf19c22RLSA-2022:6443
Rocky Linux:8mariadb3:10.5.16-2.module+el8.6.0+995+5ac2a483RLSA-2022:5826
Rocky Linux:9mariadb3:10.5.16-2.el9_0RLSA-2022:5948
Rocky Linux:9mysql-selinux0:1.0.5-1.el9_0RLSA-2022:5948

Affected products (as reported)

VendorProductVersions
MariaDB MariaDB 10.6.5

Weakness: CWE-134 · Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References