MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_compress.cc, when an error occurs (i.e., going to the err label) while executing the method create_worker_threads, the held lock thd->ctrl_mutex is not released correctly, which allows local users to trigger a denial of service due to the deadlock. Note: The vendor argues this is just an improper locking bug and not a vulnerability with adverse effects.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade mariadb-embeddedUpgrade mariadb-gssapi-serverUpgrade mariadb-serverUpgrade mariadb-testUpgrade mariadb-pamUpgrade mariadb-commonUpgrade mariadb-embedded-develUpgrade mariadb-backupUpgrade mariadb-errmsgUpgrade mariadb-develUpgrade mariadb-oqgraph-engineUpgrade mariadb-server-galeraUpgrade galeraUpgrade mariadbUpgrade mariadb-server-utilsUpgrade Judy | Aug 8, 2022 | May 25, 2022 |
| Alpine Linux | — | Upgrade mariadb | Mar 26, 2024 | May 25, 2022 |
| Amazon Linux Ami 2 | — | Upgrade mariadb-backupUpgrade mariadb-embeddedUpgrade mariadb-connect-engineUpgrade mariadb-debuginfoUpgrade mariadb-pamUpgrade mariadb-gssapi-serverUpgrade mariadb-errmsgUpgrade mariadbUpgrade mariadb-oqgraph-engineUpgrade mariadb-server-utilsUpgrade mariadb-sphinx-engineUpgrade mariadb-testUpgrade mariadb-rocksdb-engineUpgrade mariadb-develUpgrade mariadb-s3-engineUpgrade mariadb-embedded-develUpgrade mariadb-serverUpgrade mariadb-server-galeraUpgrade mariadb-configUpgrade mariadb-commonUpgrade mariadb-libsUpgrade mariadb-cracklib-password-check | Sep 28, 2023 | May 25, 2022 |
| Amazon_linux_2023 | — | Upgrade mariadb105-oqgraph-engineUpgrade mariadb105-connect-engine-debuginfoUpgrade mariadb105-backupUpgrade mariadb105-gssapi-server-debuginfoUpgrade mariadb105Upgrade mariadb105-gssapi-serverUpgrade mariadb105-debuginfoUpgrade mariadb105-rocksdb-engine-debuginfoUpgrade mariadb105-pamUpgrade mariadb105-server-utilsUpgrade mariadb105-cracklib-password-checkUpgrade mariadb105-sphinx-engineUpgrade mariadb105-commonUpgrade mariadb105-backup-debuginfoUpgrade mariadb105-serverUpgrade mariadb105-oqgraph-engine-debuginfoUpgrade mariadb105-sphinx-engine-debuginfoUpgrade mariadb105-debugsourceUpgrade mariadb105-pam-debuginfoUpgrade mariadb105-connect-engineUpgrade mariadb105-server-debuginfoUpgrade mariadb105-testUpgrade mariadb105-cracklib-password-check-debuginfoUpgrade mariadb105-develUpgrade mariadb105-rocksdb-engineUpgrade mariadb105-test-debuginfoUpgrade mariadb105-errmsgUpgrade mariadb105-server-utils-debuginfo | Feb 17, 2025 | Sep 7, 2021 |
| Centos_linux | — | Upgrade mariadb-oqgraph-engineUpgrade mysql-selinuxUpgrade galera-debugsourceUpgrade mariadb-server-utilsUpgrade mariadb-server-galeraUpgrade galeraUpgrade Judy-debuginfoUpgrade mariadb-embeddedUpgrade mariadb-serverUpgrade mariadb-develUpgrade mariadb-embedded-develUpgrade mariadb-test-debuginfoUpgrade mariadb-pam-debuginfoUpgrade mariadb-server-debuginfoUpgrade mariadb-backup-debuginfoUpgrade mariadb-server-utils-debuginfoUpgrade mariadb-commonUpgrade mariadbUpgrade mariadb-testUpgrade mariadb-debuginfoUpgrade Judy-debugsourceUpgrade galera-debuginfoUpgrade mariadb-debugsourceUpgrade JudyUpgrade mariadb-backupUpgrade mariadb-pamUpgrade mariadb-oqgraph-engine-debuginfoUpgrade mariadb-gssapi-server-debuginfoUpgrade mariadb-errmsgUpgrade mariadb-embedded-debuginfoUpgrade mariadb-gssapi-server | Aug 3, 2022 | May 25, 2022 |
| Debian | — | Upgrade mariadb-10.5 | Jul 30, 2024 | May 25, 2022 |
| Gentoo Linux | — | Upgrade dev-db/mariadb. | May 10, 2024 | May 25, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade mariadbUpgrade mariadb-develUpgrade mariadb-common | Aug 18, 2022 | May 25, 2022 |
| Mariadb Mariadb | — | Upgrade MariaDB to the latest version | Oct 13, 2025 | May 25, 2022 |
| Oracle_linux | — | Upgrade mariadb-embedded-develUpgrade mysql-selinuxUpgrade mariadb-server-galeraUpgrade mariadb-server-utilsUpgrade galeraUpgrade mariadb-embeddedUpgrade mariadb-develUpgrade mariadb-oqgraph-engineUpgrade mariadb-serverUpgrade JudyUpgrade mariadb-pamUpgrade mariadb-gssapi-serverUpgrade mariadbUpgrade mariadb-commonUpgrade mariadb-backupUpgrade mariadb-errmsgUpgrade mariadb-test | Aug 4, 2022 | Sep 7, 2021 |
| Redhat_linux | — | Upgrade mariadb-server-debuginfoUpgrade mariadb-server-galeraNo solution existsUpgrade mariadb-pam-debuginfoUpgrade mariadb-backup-debuginfoUpgrade mariadb-server-utils-debuginfoUpgrade mariadb-test-debuginfoUpgrade mariadb-debuginfoUpgrade mariadb-develUpgrade mariadb-embeddedUpgrade mariadb-gssapi-server-debuginfoUpgrade mariadb-server-utilsUpgrade Judy-debuginfoUpgrade mariadb-embedded-develUpgrade mariadb-backupUpgrade JudyUpgrade mariadb-oqgraph-engine-debuginfoUpgrade mariadb-testUpgrade mariadbUpgrade galera-debugsourceUpgrade mysql-selinuxUpgrade mariadb-errmsgUpgrade mariadb-embedded-debuginfoUpgrade mariadb-debugsourceUpgrade mariadb-commonUpgrade mariadb-serverUpgrade mariadb-oqgraph-engineUpgrade Judy-debugsourceUpgrade galeraUpgrade mariadb-gssapi-serverUpgrade mariadb-pamUpgrade galera-debuginfo | Aug 3, 2022 | May 25, 2022 |
| Rocky_linux | — | Upgrade mariadb-debuginfoUpgrade galeraUpgrade mariadb-debugsourceUpgrade mariadbUpgrade mariadb-gssapi-serverUpgrade Judy-debuginfoUpgrade mariadb-server-utilsUpgrade Judy-debugsourceUpgrade mariadb-backup-debuginfoUpgrade mariadb-oqgraph-engine-debuginfoUpgrade mariadb-testUpgrade mariadb-pam-debuginfoUpgrade galera-debugsourceUpgrade mariadb-gssapi-server-debuginfoUpgrade mariadb-serverUpgrade mariadb-embeddedUpgrade mariadb-server-utils-debuginfoUpgrade mariadb-commonUpgrade mariadb-backupUpgrade mariadb-develUpgrade mariadb-embedded-develUpgrade mariadb-server-debuginfoUpgrade JudyUpgrade galera-debuginfoUpgrade mariadb-test-debuginfoUpgrade mariadb-oqgraph-engineUpgrade mariadb-server-galeraUpgrade mariadb-errmsgUpgrade mariadb-embedded-debuginfoUpgrade mariadb-pam | Mar 12, 2024 | May 25, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub