MariaDB CONNECT Storage Engine Use-After-Free Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16207.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- CVSS 3.0 Base Score: 7
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade mariadbUpgrade mariadb-pamUpgrade mariadb-server-galeraUpgrade mariadb-errmsgUpgrade mariadb-commonUpgrade mariadb-develUpgrade mariadb-embedded-develUpgrade JudyUpgrade mariadb-oqgraph-engineUpgrade mariadb-gssapi-serverUpgrade mariadb-backupUpgrade galeraUpgrade mariadb-testUpgrade mariadb-serverUpgrade mariadb-embeddedUpgrade mariadb-server-utils | Aug 8, 2022 | Feb 18, 2022 |
| Alpine Linux | — | Upgrade mariadb | Aug 22, 2024 | Feb 18, 2022 |
| Amazon Linux Ami 2 | — | Upgrade mariadb-embeddedUpgrade mariadb-testUpgrade mariadb-develUpgrade mariadb-rocksdb-engineUpgrade mariadb-pamUpgrade mariadb-s3-engineUpgrade mariadb-sphinx-engineUpgrade mariadb-cracklib-password-checkUpgrade mariadb-server-utilsUpgrade mariadb-configUpgrade mariadb-oqgraph-engineUpgrade mariadb-connect-engineUpgrade mariadbUpgrade mariadb-backupUpgrade mariadb-embedded-develUpgrade mariadb-commonUpgrade mariadb-gssapi-serverUpgrade mariadb-debuginfoUpgrade mariadb-serverUpgrade mariadb-libsUpgrade mariadb-server-galeraUpgrade mariadb-errmsg | Sep 28, 2023 | Feb 18, 2022 |
| Amazon_linux_2023 | — | Upgrade mariadb105-server-utils-debuginfoUpgrade mariadb105-oqgraph-engine-debuginfoUpgrade mariadb105-pam-debuginfoUpgrade mariadb105-errmsgUpgrade mariadb105-cracklib-password-check-debuginfoUpgrade mariadb105-test-debuginfoUpgrade mariadb105-debugsourceUpgrade mariadb105-backupUpgrade mariadb105-debuginfoUpgrade mariadb105-develUpgrade mariadb105-server-debuginfoUpgrade mariadb105-sphinx-engineUpgrade mariadb105-rocksdb-engine-debuginfoUpgrade mariadb105-sphinx-engine-debuginfoUpgrade mariadb105-oqgraph-engineUpgrade mariadb105-rocksdb-engineUpgrade mariadb105-connect-engine-debuginfoUpgrade mariadb105-gssapi-server-debuginfoUpgrade mariadb105-server-utilsUpgrade mariadb105Upgrade mariadb105-backup-debuginfoUpgrade mariadb105-cracklib-password-checkUpgrade mariadb105-connect-engineUpgrade mariadb105-pamUpgrade mariadb105-serverUpgrade mariadb105-gssapi-serverUpgrade mariadb105-testUpgrade mariadb105-common | Feb 17, 2025 | Feb 18, 2022 |
| Centos_linux | — | Upgrade mariadb-embedded-develUpgrade mariadb-backupUpgrade mariadb-pamUpgrade mariadb-server-galeraUpgrade galera-debuginfoUpgrade mariadb-oqgraph-engine-debuginfoUpgrade mariadb-develUpgrade mariadb-commonUpgrade JudyUpgrade mariadb-server-debuginfoUpgrade mariadb-test-debuginfoUpgrade mariadb-errmsgUpgrade mariadb-debugsourceUpgrade mariadb-server-utils-debuginfoUpgrade mysql-selinuxUpgrade mariadb-debuginfoUpgrade mariadb-pam-debuginfoUpgrade mariadb-gssapi-server-debuginfoUpgrade mariadb-gssapi-serverUpgrade Judy-debuginfoUpgrade mariadb-serverUpgrade mariadb-embeddedUpgrade mariadb-server-utilsUpgrade mariadb-backup-debuginfoUpgrade mariadb-embedded-debuginfoUpgrade mariadbUpgrade galera-debugsourceUpgrade mariadb-testUpgrade galeraUpgrade mariadb-oqgraph-engineUpgrade Judy-debugsource | Aug 3, 2022 | Feb 18, 2022 |
| Debian | — | Upgrade mariadb-10.5 | Jul 30, 2024 | Feb 18, 2022 |
| Freebsd | — | Upgrade mariadb105-clientUpgrade mariadb103-serverUpgrade mariadb103-clientUpgrade mariadb105-serverUpgrade mariadb104-clientUpgrade mariadb104-server | Nov 4, 2022 | Feb 10, 2022 |
| Gentoo Linux | — | Upgrade dev-db/mariadb. | May 10, 2024 | Feb 18, 2022 |
| Mariadb Mariadb | — | Upgrade MariaDB to the latest version | Mar 4, 2025 | Feb 18, 2022 |
| Oracle_linux | — | Upgrade mariadb-serverUpgrade mariadbUpgrade mariadb-embeddedUpgrade mariadb-gssapi-serverUpgrade mariadb-testUpgrade mariadb-backupUpgrade mariadb-server-utilsUpgrade mariadb-errmsgUpgrade mariadb-pamUpgrade mariadb-develUpgrade mariadb-server-galeraUpgrade galeraUpgrade mariadb-commonUpgrade mariadb-oqgraph-engineUpgrade mariadb-embedded-develUpgrade JudyUpgrade mysql-selinux | Aug 4, 2022 | Feb 18, 2022 |
| Redhat_linux | — | Upgrade mariadb-oqgraph-engine-debuginfoUpgrade Judy-debugsourceUpgrade mariadb-backupUpgrade mariadb-embedded-debuginfoNo solution existsUpgrade mariadb-commonUpgrade galera-debuginfoUpgrade mariadb-pamUpgrade mariadb-test-debuginfoUpgrade mariadb-backup-debuginfoUpgrade mariadb-testUpgrade mariadb-server-galeraUpgrade JudyUpgrade mariadb-embedded-develUpgrade mariadb-develUpgrade galeraUpgrade mariadb-serverUpgrade mariadb-embeddedUpgrade mysql-selinuxUpgrade mariadb-errmsgUpgrade mariadb-gssapi-serverUpgrade mariadb-debuginfoUpgrade mariadb-pam-debuginfoUpgrade mariadb-oqgraph-engineUpgrade galera-debugsourceUpgrade mariadb-server-utils-debuginfoUpgrade mariadbUpgrade mariadb-debugsourceUpgrade mariadb-server-utilsUpgrade Judy-debuginfoUpgrade mariadb-server-debuginfoUpgrade mariadb-gssapi-server-debuginfo | Aug 3, 2022 | Feb 18, 2022 |
| Rocky_linux | — | Upgrade galera-debugsourceUpgrade galeraUpgrade mariadbUpgrade mariadb-debuginfoUpgrade mariadb-embedded-develUpgrade mariadb-server-galeraUpgrade mariadb-server-utilsUpgrade mariadb-errmsgUpgrade mariadb-test-debuginfoUpgrade mariadb-gssapi-serverUpgrade Judy-debuginfoUpgrade mariadb-backupUpgrade mariadb-develUpgrade mariadb-serverUpgrade mariadb-server-utils-debuginfoUpgrade mariadb-oqgraph-engineUpgrade mariadb-embeddedUpgrade mariadb-embedded-debuginfoUpgrade mariadb-pam-debuginfoUpgrade mariadb-testUpgrade Judy-debugsourceUpgrade galera-debuginfoUpgrade mariadb-commonUpgrade mariadb-oqgraph-engine-debuginfoUpgrade mariadb-backup-debuginfoUpgrade mariadb-pamUpgrade mariadb-gssapi-server-debuginfoUpgrade JudyUpgrade mariadb-debugsourceUpgrade mariadb-server-debuginfo | Mar 12, 2024 | Feb 18, 2022 |
| Suse | — | Upgrade mariadb-toolsUpgrade mariadb104-errormessagesUpgrade mariadb104-toolsUpgrade mariadb104Upgrade mariadb-galeraUpgrade libmariadbd19Upgrade liblz4-1Upgrade libmariadb-develUpgrade mariadb104-benchUpgrade libmysqld-develUpgrade mariadb-testUpgrade mariadb-rpm-macrosUpgrade python3-mysqlclientUpgrade mariadb104-clientUpgrade mariadb104-testUpgrade mariadbUpgrade libmariadbd-develUpgrade mariadb104-rpm-macrosUpgrade libmariadb_pluginsUpgrade libmariadbd104-develUpgrade mariadb-clientUpgrade libmysqld19Upgrade mariadb104-galeraUpgrade libmariadb3Upgrade mariadb-errormessagesUpgrade mariadb-bench | Mar 5, 2022 | Feb 18, 2022 |
| Ubuntu | — | Upgrade mariadb-server | Mar 22, 2023 | Feb 18, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 18, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub