Log in Start free

Vulnerability · Published Feb 18, 2022 · Assigned by zdi

CVE-2022-24052

High 7.0

In plain English

A high-severity heap buffer overflow in MariaDB from MariaDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.0)7.0High
Exploit odds (30 days)0.7%top 46.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16190.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8Judy1.0.5-18.module_el8.6.0+3139+3c630e87ALSA-2022:6443
AlmaLinux:8Judy1.0.5-18.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:8Judy1.0.5-18.module_el8.6.0+3072+3c630e87ALSA-2022:6443
AlmaLinux:8galera25.3.35-1.module_el8.6.0+3265+230ed96bALSA-2022:6443
AlmaLinux:8galera26.4.11-1.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:8mariadb3:10.3.35-1.module_el8.6.0+3265+230ed96bALSA-2022:6443
AlmaLinux:8mariadb3:10.5.16-2.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:9mariadb3:10.5.16-2.el9_0ALSA-2022:5948
AlmaLinux:8mariadb-backup3:10.3.35-1.module_el8.6.0+3265+230ed96bALSA-2022:6443
AlmaLinux:8mariadb-backup3:10.5.16-2.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:9mariadb-backup3:10.5.16-2.el9_0ALSA-2022:5948
AlmaLinux:8mariadb-common3:10.3.35-1.module_el8.6.0+3265+230ed96bALSA-2022:6443
AlmaLinux:8mariadb-common3:10.5.16-2.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:9mariadb-common3:10.5.16-2.el9_0ALSA-2022:5948
AlmaLinux:8mariadb-devel3:10.5.16-2.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:8mariadb-devel3:10.3.35-1.module_el8.6.0+3265+230ed96bALSA-2022:6443
AlmaLinux:9mariadb-devel3:10.5.16-2.el9_0ALSA-2022:5948
AlmaLinux:8mariadb-embedded3:10.3.35-1.module_el8.6.0+3265+230ed96bALSA-2022:6443
AlmaLinux:8mariadb-embedded3:10.5.16-2.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:9mariadb-embedded3:10.5.16-2.el9_0ALSA-2022:5948
AlmaLinux:8mariadb-embedded-devel3:10.5.16-2.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:8mariadb-embedded-devel3:10.3.35-1.module_el8.6.0+3265+230ed96bALSA-2022:6443
AlmaLinux:9mariadb-embedded-devel3:10.5.16-2.el9_0ALSA-2022:5948
AlmaLinux:8mariadb-errmsg3:10.5.16-2.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:8mariadb-errmsg3:10.3.35-1.module_el8.6.0+3265+230ed96bALSA-2022:6443
AlmaLinux:9mariadb-errmsg3:10.5.16-2.el9_0ALSA-2022:5948
AlmaLinux:8mariadb-gssapi-server3:10.3.35-1.module_el8.6.0+3265+230ed96bALSA-2022:6443
AlmaLinux:8mariadb-gssapi-server3:10.5.16-2.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:9mariadb-gssapi-server3:10.5.16-2.el9_0ALSA-2022:5948
AlmaLinux:8mariadb-oqgraph-engine3:10.5.16-2.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:8mariadb-oqgraph-engine3:10.3.35-1.module_el8.6.0+3265+230ed96bALSA-2022:6443
AlmaLinux:9mariadb-oqgraph-engine3:10.5.16-2.el9_0ALSA-2022:5948
AlmaLinux:8mariadb-pam3:10.5.16-2.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:9mariadb-pam3:10.5.16-2.el9_0ALSA-2022:5948
AlmaLinux:8mariadb-server3:10.5.16-2.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:8mariadb-server3:10.3.35-1.module_el8.6.0+3265+230ed96bALSA-2022:6443
AlmaLinux:9mariadb-server3:10.5.16-2.el9_0ALSA-2022:5948
AlmaLinux:8mariadb-server-galera3:10.3.35-1.module_el8.6.0+3265+230ed96bALSA-2022:6443
AlmaLinux:8mariadb-server-galera3:10.5.16-2.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:9mariadb-server-galera3:10.5.16-2.el9_0ALSA-2022:5948
AlmaLinux:8mariadb-server-utils3:10.5.16-2.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:8mariadb-server-utils3:10.3.35-1.module_el8.6.0+3265+230ed96bALSA-2022:6443
AlmaLinux:9mariadb-server-utils3:10.5.16-2.el9_0ALSA-2022:5948
AlmaLinux:8mariadb-test3:10.5.16-2.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:8mariadb-test3:10.3.35-1.module_el8.6.0+3265+230ed96bALSA-2022:6443
AlmaLinux:9mariadb-test3:10.5.16-2.el9_0ALSA-2022:5948
Alpine:v3.20mariadb10.6.7-r0ALPINE-CVE-2022-24052
Alpine:v3.21mariadb10.6.7-r0ALPINE-CVE-2022-24052
Alpine:v3.22mariadb10.6.7-r0ALPINE-CVE-2022-24052
Alpine:v3.23mariadb10.6.7-r0ALPINE-CVE-2022-24052
Alpine:v3.24mariadb10.6.7-r0ALPINE-CVE-2022-24052
Rocky Linux:8Judy0:1.0.5-18.module+el8.4.0+427+adf35707RLSA-2022:6443
Rocky Linux:8Judy0:1.0.5-18.module+el8.4.0+427+adf35707RLSA-2022:5826
Rocky Linux:8galera0:25.3.35-1.module+el8.6.0+1005+cdf19c22RLSA-2022:6443
Rocky Linux:8galera0:26.4.11-1.module+el8.6.0+995+5ac2a483RLSA-2022:5826
Rocky Linux:9galera0:26.4.11-1.el9_0RLSA-2022:5948
Rocky Linux:8mariadb3:10.3.35-1.module+el8.6.0+1005+cdf19c22RLSA-2022:6443
Rocky Linux:8mariadb3:10.5.16-2.module+el8.6.0+995+5ac2a483RLSA-2022:5826
Rocky Linux:9mariadb3:10.5.16-2.el9_0RLSA-2022:5948
Rocky Linux:9mysql-selinux0:1.0.5-1.el9_0RLSA-2022:5948

Affected products (as reported)

VendorProductVersions
MariaDB MariaDB 10.6.5

Weakness: CWE-122 · Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References