Log in Start free

Vulnerability · Published Feb 18, 2022 · Assigned by zdi

CVE-2022-24050

High 7.0

In plain English

A high-severity use-after-free in MariaDB from MariaDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.0)7.0High
Exploit odds (30 days)0.6%top 49.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

MariaDB CONNECT Storage Engine Use-After-Free Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16207.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8Judy1.0.5-18.module_el8.6.0+3139+3c630e87ALSA-2022:6443
AlmaLinux:8Judy1.0.5-18.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:8Judy1.0.5-18.module_el8.6.0+3072+3c630e87ALSA-2022:6443
AlmaLinux:8galera25.3.35-1.module_el8.6.0+3265+230ed96bALSA-2022:6443
AlmaLinux:8galera26.4.11-1.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:8mariadb3:10.3.35-1.module_el8.6.0+3265+230ed96bALSA-2022:6443
AlmaLinux:8mariadb3:10.5.16-2.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:9mariadb3:10.5.16-2.el9_0ALSA-2022:5948
AlmaLinux:8mariadb-backup3:10.3.35-1.module_el8.6.0+3265+230ed96bALSA-2022:6443
AlmaLinux:8mariadb-backup3:10.5.16-2.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:9mariadb-backup3:10.5.16-2.el9_0ALSA-2022:5948
AlmaLinux:8mariadb-common3:10.3.35-1.module_el8.6.0+3265+230ed96bALSA-2022:6443
AlmaLinux:8mariadb-common3:10.5.16-2.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:9mariadb-common3:10.5.16-2.el9_0ALSA-2022:5948
AlmaLinux:8mariadb-devel3:10.5.16-2.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:8mariadb-devel3:10.3.35-1.module_el8.6.0+3265+230ed96bALSA-2022:6443
AlmaLinux:9mariadb-devel3:10.5.16-2.el9_0ALSA-2022:5948
AlmaLinux:8mariadb-embedded3:10.3.35-1.module_el8.6.0+3265+230ed96bALSA-2022:6443
AlmaLinux:8mariadb-embedded3:10.5.16-2.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:9mariadb-embedded3:10.5.16-2.el9_0ALSA-2022:5948
AlmaLinux:8mariadb-embedded-devel3:10.5.16-2.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:8mariadb-embedded-devel3:10.3.35-1.module_el8.6.0+3265+230ed96bALSA-2022:6443
AlmaLinux:9mariadb-embedded-devel3:10.5.16-2.el9_0ALSA-2022:5948
AlmaLinux:8mariadb-errmsg3:10.5.16-2.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:8mariadb-errmsg3:10.3.35-1.module_el8.6.0+3265+230ed96bALSA-2022:6443
AlmaLinux:9mariadb-errmsg3:10.5.16-2.el9_0ALSA-2022:5948
AlmaLinux:8mariadb-gssapi-server3:10.3.35-1.module_el8.6.0+3265+230ed96bALSA-2022:6443
AlmaLinux:8mariadb-gssapi-server3:10.5.16-2.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:9mariadb-gssapi-server3:10.5.16-2.el9_0ALSA-2022:5948
AlmaLinux:8mariadb-oqgraph-engine3:10.5.16-2.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:8mariadb-oqgraph-engine3:10.3.35-1.module_el8.6.0+3265+230ed96bALSA-2022:6443
AlmaLinux:9mariadb-oqgraph-engine3:10.5.16-2.el9_0ALSA-2022:5948
AlmaLinux:8mariadb-pam3:10.5.16-2.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:9mariadb-pam3:10.5.16-2.el9_0ALSA-2022:5948
AlmaLinux:8mariadb-server3:10.5.16-2.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:8mariadb-server3:10.3.35-1.module_el8.6.0+3265+230ed96bALSA-2022:6443
AlmaLinux:9mariadb-server3:10.5.16-2.el9_0ALSA-2022:5948
AlmaLinux:8mariadb-server-galera3:10.3.35-1.module_el8.6.0+3265+230ed96bALSA-2022:6443
AlmaLinux:8mariadb-server-galera3:10.5.16-2.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:9mariadb-server-galera3:10.5.16-2.el9_0ALSA-2022:5948
AlmaLinux:8mariadb-server-utils3:10.5.16-2.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:8mariadb-server-utils3:10.3.35-1.module_el8.6.0+3265+230ed96bALSA-2022:6443
AlmaLinux:9mariadb-server-utils3:10.5.16-2.el9_0ALSA-2022:5948
AlmaLinux:8mariadb-test3:10.5.16-2.module_el8.6.0+3072+3c630e87ALSA-2022:5826
AlmaLinux:8mariadb-test3:10.3.35-1.module_el8.6.0+3265+230ed96bALSA-2022:6443
AlmaLinux:9mariadb-test3:10.5.16-2.el9_0ALSA-2022:5948
Alpine:v3.20mariadb10.6.7-r0ALPINE-CVE-2022-24050
Alpine:v3.21mariadb10.6.7-r0ALPINE-CVE-2022-24050
Alpine:v3.22mariadb10.6.7-r0ALPINE-CVE-2022-24050
Alpine:v3.23mariadb10.6.7-r0ALPINE-CVE-2022-24050
Alpine:v3.24mariadb10.6.7-r0ALPINE-CVE-2022-24050
Rocky Linux:8Judy0:1.0.5-18.module+el8.4.0+427+adf35707RLSA-2022:6443
Rocky Linux:8Judy0:1.0.5-18.module+el8.4.0+427+adf35707RLSA-2022:5826
Rocky Linux:8galera0:25.3.35-1.module+el8.6.0+1005+cdf19c22RLSA-2022:6443
Rocky Linux:8galera0:26.4.11-1.module+el8.6.0+995+5ac2a483RLSA-2022:5826
Rocky Linux:9galera0:26.4.11-1.el9_0RLSA-2022:5948
Rocky Linux:8mariadb3:10.3.35-1.module+el8.6.0+1005+cdf19c22RLSA-2022:6443
Rocky Linux:8mariadb3:10.5.16-2.module+el8.6.0+995+5ac2a483RLSA-2022:5826
Rocky Linux:9mariadb3:10.5.16-2.el9_0RLSA-2022:5948
Rocky Linux:9mysql-selinux0:1.0.5-1.el9_0RLSA-2022:5948

Affected products (as reported)

VendorProductVersions
MariaDB MariaDB 10.6.5

Weakness: CWE-416 · Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References